WorksheetsDay 4 Sec+ Review
Total questions: 18
Worksheet time: 9mins
What is the primary reason NIST discourages password hints?
They take up system memory
They can expose part of the password or related personal information
They make passwords too complex
They interfere with multifactor authentication
Which of the following combinations represents true multifactor
authentication?
Password and PIN
Password and security question
Smart card and fingerprint scan
Password and username
A user’s fingerprint is valid but the system repeatedly denies access. Which
error is occurring?
False Rejection Rate (FRR)
False Acceptance Rate (FAR)
Type II Error
Throughput Limitation
Which authentication method relies on a hardware device containing a user’s
private key and digital certificate issued by a PKI?
One-time password token
Biometric scanner
Password vault
Certificate-based token
Which soft token method generates time-based one-time passwords locally on
a user’s smartphone?
Push notification
Email link
Authenticator app
Phone call verification
What does attestation provide in the context of passwordless authentication?
Proof that the authenticator device is trusted and genuine
Encryption of the user’s session data
Automatic registration of new accounts
Certificate renewal for the authenticator
Which of the following best represents how access is controlled in a MAC
system?
Based on user discretion and sharing preferences
Based on labels assigned to data and clearances assigned to users
Based on group membership and inherited rights
Based on user location and network segment
Which statement best describes Role-Based Access Control (RBAC)?
Permissions are assigned directly to each user account
Permissions are based on labels and clearance levels.
Users inherit permissions through their assigned roles.
Access decisions depend on environmental conditions.
In a network environment, a policy states: “Users can only log in between 8
a.m. and 6 p.m.” This is an example of:
Role-Based Access Control (RBAC)
Mandatory Access Control (MAC)
Discretionary Access Control (DAC)
Rule-Based Access Control (RuBAC)
The primary goal of the Principle of Least Privilege is to:
Allow all users full access to improve efficiency
Assign permissions based on seniority
Restrict user permissions to the minimum necessary for job duties
Deny all access unless users are administrators
What is a security risk associated with failing to deprovision user accounts
properly?
Orphaned accounts that can be exploited
Decreased system performance
Lost encryption keys
Misconfigured DNS records
What is the primary function of Group Policy Objects (GPOs) in Active
Directory?
To manage DNS and DHCP configuration
To store encrypted passwords for all users
To assign new usernames to existing user accounts
To enforce consistent system and security configurations for users and
computers
A user logs in from Texas and, 15 minutes later, appears to log in from Europe.
What control would detect this event?
Logon duration restriction
Authorization creep
Impossible travel time detection
Account lockout
What authentication protocol does Windows Active Directory primarily use for
network sign-ins?
RADIUS
NTLM
Kerberos
TACACS+
Which protocol is most commonly used to query and modify directory services
over a network?
SSH
LDAP
FTP
SNMP
What is the primary function of the Service Ticket in Kerberos?
It provides encrypted proof of authorization to access a specific service.
It contains the user’s password for quick verification
It allows password resets across all services
It grants administrative rights automatically.
What is the primary purpose of federation in identity management?
To store passwords in plaintext across multiple organizations
To enforce local authentication policies on every external user
To synchronize all users’ passwords between systems
To enable different organizations to share authentication and identity
information securely
Which data format is used by SAML to structure authentication and
authorization information?
XML
JSON
CSV
YAML
