Access Control Fundamentals Quiz

<p>That actions taken on data can be traced back to an individual (A)</p> Signup and view all the answers

<p>It verifies the identities of users requesting access (C)</p> Signup and view all the answers

<p>Unauthorized access attempts (B)</p> Signup and view all the answers

<p>Management of access rights spread across multiple sources (D)</p> Signup and view all the answers

<p>Verification (B)</p> Signup and view all the answers

<p>It grants or rejects requests based on predefined authorizations. (B)</p> Signup and view all the answers

<p>Physical Access Control (B)</p> Signup and view all the answers

<p>It is the central point for enforcing access control and mediating requests. (D)</p> Signup and view all the answers

<p>A card programmed with an ID number to control physical resource access. (B)</p> Signup and view all the answers

<p>Policy enforcement phase (C)</p> Signup and view all the answers

<p>To monitor and influence user behavior on a computer system. (B)</p> Signup and view all the answers

<p>Encryption (B)</p> Signup and view all the answers

<p>Monitoring user access rights and system interactions. (D)</p> Signup and view all the answers

<p>The individual must be physically present to authenticate. (D)</p> Signup and view all the answers

<p>Signature motions (A)</p> Signup and view all the answers

<p>It can have accuracy issues. (B)</p> Signup and view all the answers

<p>Synchronous tokens use a fixed method of calculation. (D)</p> Signup and view all the answers

<p>Iris scan (D)</p> Signup and view all the answers

<p>Complexity of algorithms (B)</p> Signup and view all the answers

<p>Physiological measures (B)</p> Signup and view all the answers

<p>Asynchronous token (B)</p> Signup and view all the answers

<p>Full, change, read, deny (C)</p> Signup and view all the answers

<p>User's assigned role within the organization (A)</p> Signup and view all the answers

<p>Data encryption (B)</p> Signup and view all the answers

<p>Disclosure of private information (B)</p> Signup and view all the answers

<p>Clark–Wilson integrity model (A)</p> Signup and view all the answers

<p>Conflict of interest management (B)</p> Signup and view all the answers

<p>Application layer attacks (A)</p> Signup and view all the answers

<p>Role-Based Access Control (D)</p> Signup and view all the answers

<p>Loss of customer confidence (B)</p> Signup and view all the answers

<p>RADIUS (D)</p> Signup and view all the answers

<p>Eavesdropping by observation (A)</p> Signup and view all the answers

<p>More oversight (B)</p> Signup and view all the answers

<p>Individuals closest to the users (C)</p> Signup and view all the answers

<p>Enhanced competitiveness (A)</p> Signup and view all the answers

<p>Group Policy Objects (A)</p> Signup and view all the answers

<p>SAML (B)</p> Signup and view all the answers

<p>Challenge-Handshake Authentication Protocol (CHAP) (B)</p> Signup and view all the answers

<p>Community Cloud (D)</p> Signup and view all the answers

<p>Keystroke logging (C)</p> Signup and view all the answers

<p>To control access to services and data based on user roles (D)</p> Signup and view all the answers

<p>Time-based One-Time Password (TOTP) (B)</p> Signup and view all the answers

<p>Monitoring usage of office supplies (C)</p> Signup and view all the answers

<p>Delivers virtualized computing resources over the internet (C)</p> Signup and view all the answers

<p>They generate a one-time password for a single use (D)</p> Signup and view all the answers

Protecting a resource so only authorized users can use it.

Determining who is requesting access to an asset.

Verifying the identity of a user requesting access.

Determining what resources a user has permission to access.

Tracking who made changes to a system or data.

Determining user access privileges and allowed resources/systems.

Implementing the access controls defined in the policies.

Access control system with components of Identification, Authentication, Authorization, & Accountability.

A sequential process for controlling access, often involving authorization and policy enforcement.

The stage where access requests are granted or denied based on previously defined authorizations.

Security measures to control entry into physical locations such as buildings and parking lots.

Security measures to control access to computer systems and networks.

Physical cards that store user identification and are used for access control in physical environments.

A central component in a computer system that enforces access control.

A concept used by security kernels to mediate all access requests.

Rules that determine which users have access to which resources in a system.

Strategies for creating strong passwords that improve account security.

A security token that calculates a number simultaneously on the authentication server and device to verify identity.

A security token that uses challenge-response technology; the device sends a response to a challenge.

A biometric measurement of physical characteristics that don't change (e.g., fingerprints, iris scan).

A biometric measurement of behavioral characteristics that change (e.g., signature, keystroke).

Issues related to reaction time, accuracy, and acceptance of biometric authentication methods.

A biometric authentication method that uses unique fingerprint patterns to verify identity.

Rules that govern the creation and usage of passwords for accounts.

Gaining unauthorized access to information by observing physical activities, such as looking over someone's shoulder or reading documents left unattended.

Gaining unauthorized access by circumventing security mechanisms, such as using a backdoor, exploiting vulnerabilities, or using social engineering.

Gaining unauthorized access by exploiting weaknesses in system hardware or software, such as vulnerabilities in operating systems, applications, or network devices.

Gaining unauthorized access by retrieving sensitive information from discarded or reused media, such as old hard drives, floppy disks, or even old USB drives.

Gaining unauthorized access to information by intercepting electronic communications, such as phone calls, emails, or data transmissions.

Gaining unauthorized access to information by intercepting and decoding messages, such as tapping into communication lines or using packet sniffers.

Gaining unauthorized access to a network, such as by exploiting vulnerabilities in network devices or using brute force attacks.

Gaining unauthorized access to information by exploiting vulnerabilities in applications, such as web browsers, databases, or other software.

Lists of permissions that specify who can access resources and what they can do (e.g., read, write, execute).

An access control model that grants access based on the roles a user plays within a system (e.g., administrator, editor, viewer).

Access control that restricts access based on the characteristics or types of data.

Restricting user interaction to prevent unauthorized data access or modification.

A model for access control that focuses on preventing conflicts of interest in access.

Compromised security can lead to data breaches, corruption of information, loss of insights, and damage to systems.

Actions that could bypass security measures to gain unauthorized access or create security threats.

File access control method for Linux and macOS using read, write, and execute.

A simple authentication protocol where the user's password is sent in clear text.

A more secure authentication protocol that uses a challenge-response mechanism to verify the user's identity.

A type of one-time password (OTP) that uses a hash-based message authentication code (HMAC) to generate a unique code for each login attempt.

A type of OTP that uses a time-based algorithm to generate a unique code that expires after a certain time period.

A system that manages user identities and controls access to organizational resources.

A specialized system that manages and restricts access for users with high-level privileges.

A cloud computing environment managed by a single organization for its own use.

A cloud service model that provides access to computing resources like servers, storage, and networking.