Database Views
200 Questions
0 Views

Choose a study mode

Play Quiz
Study Flashcards
Spaced Repetition
Chat to lesson

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

What is the primary factor considered when implementing biometric identification systems?

  • Habits and identification part of the body
  • Unique physical attributes or behavior (correct)
  • Income level and tone of voice
  • Age and sex of a person

    • What is the first step in protecting data's confidentiality?

  • Reviewing user access rights
  • Installing a firewall
  • Identifying sensitive information (correct)
  • Implementing encryption

    • What type of access control is based on an individual's identity?

  • Non-Discretionary Access Control
  • Rule-based Access control
  • Identity-based Access control (correct)
  • Lattice-based Access control

    • What is the primary purpose of biometric identification systems?

    <p>To uniquely identify a person</p> Signup and view all the answers

    What is the main goal of protecting data's confidentiality?

    <p>To ensure only authorized access</p> Signup and view all the answers

    What type of access control is based on a set of rules?

    <p>Rule-based Access control</p> Signup and view all the answers

    What is the primary consideration when implementing discretionary access control?

    <p>Identity of an individual</p> Signup and view all the answers

    What is the primary mechanism to protect sensitive information after identification?

    <p>Implementing encryption</p> Signup and view all the answers

    What is the primary purpose of views in a database?

    <p>To provide abstraction and simplify database design</p> Signup and view all the answers

    What is a key benefit of using views in a database?

    <p>Easier data normalization</p> Signup and view all the answers

    What is a characteristic of rows available through a view?

    <p>They are not sorted</p> Signup and view all the answers

    What is the purpose of abstraction in database design?

    <p>To simplify database design</p> Signup and view all the answers

    What is the term for testing internal structures or workings of an application?

    <p>White-box testing</p> Signup and view all the answers

    What is the opposite of white-box testing?

    <p>Black-box testing</p> Signup and view all the answers

    What is the purpose of normalization in database design?

    <p>To reduce data redundancy</p> Signup and view all the answers

    What is a benefit of using views to aggregate data?

    <p>Simplified database design</p> Signup and view all the answers

    What is the primary focus of the Bell-LaPadula model?

    <p>Data confidentiality</p> Signup and view all the answers

    Who developed the Bell-LaPadula model?

    <p>David Elliott Bell and Leonard J. LaPadula</p> Signup and view all the answers

    What is the primary goal of the Bell-LaPadula model?

    <p>To formalize the U.S. Department of Defense multilevel security policy</p> Signup and view all the answers

    What is the purpose of security labels in the Bell-LaPadula model?

    <p>To classify objects as sensitive or unclassified</p> Signup and view all the answers

    What is a 'secure state' in the Bell-LaPadula model?

    <p>A state where only permitted access modes are allowed</p> Signup and view all the answers

    What is the relationship between subjects and objects in the Bell-LaPadula model?

    <p>Entities in an information system are divided into subjects and objects</p> Signup and view all the answers

    What is the purpose of transition functions in the Bell-LaPadula model?

    <p>To define the transition from one state to another</p> Signup and view all the answers

    What is the benefit of the Bell-LaPadula model?

    <p>It proves that the system satisfies the security objectives</p> Signup and view all the answers

    What is the main difference between the Biba model and the Bell-LaPadula model?

    <p>The Biba model has the reverse rules of the Bell-LaPadula model.</p> Signup and view all the answers

    What is the purpose of the 'no read down' integrity rule in the Biba model?

    <p>To prevent a subject from reading an object at a lower integrity level.</p> Signup and view all the answers

    What is the 'Simple Integrity Axiom' in the Biba model?

    <p>A subject at a given level of integrity must not read an object at a lower integrity level.</p> Signup and view all the answers

    What is the '* (star) Integrity Axiom' in the Biba model?

    <p>A subject at a given level of integrity must not write to an object at a higher integrity level.</p> Signup and view all the answers

    What is the main concept behind Lattice-Based Access Control (LBAC)?

    <p>A subject's access to an object is determined by the subject's integrity level.</p> Signup and view all the answers

    What is the mathematical expression of the security level access in Lattice-Based Access Control (LBAC)?

    <p>The greatest lower bound (meet) of the levels of the subject and object.</p> Signup and view all the answers

    What is the result of combining two objects X and Y in Lattice-Based Access Control (LBAC)?

    <p>A new object Z, which is assigned the security level formed by the join of the levels of X and Y.</p> Signup and view all the answers

    What is the purpose of the lattice in Lattice-Based Access Control (LBAC)?

    <p>To define the levels of security that a subject may have access to and that an object may have.</p> Signup and view all the answers

    What is the primary objective of the information flow model developed by Dorothy Denning?

    <p>To address covert channels</p> Signup and view all the answers

    Which access control category is designed to specify rules of acceptable behavior in an organization?

    <p>Organizational Security Policy</p> Signup and view all the answers

    What is a characteristic of two-factor authentication?

    <p>It relies on two independent proofs of identity</p> Signup and view all the answers

    What is NOT a characteristic of two-factor authentication?

    <p>It relies on hand geometry for authentication</p> Signup and view all the answers

    Which of the following is an incorrect statement about two-factor authentication?

    <p>It requires two measurements of hand geometry</p> Signup and view all the answers

    What is the purpose of the information flow model?

    <p>To address covert channels</p> Signup and view all the answers

    What is an incorrect statement about access control categories?

    <p>Organizational Security Policy is not one of the seven types</p> Signup and view all the answers

    What is a characteristic of the Bell-LaPadula model?

    <p>It is a type of mandatory access control</p> Signup and view all the answers

    What type of error occurs when an application or system is vulnerable due to an unexpected interaction with the operating system or another application?

    <p>Exceptional condition handling error</p> Signup and view all the answers

    Which biometric device has the highest precision rate?

    <p>Retina scan</p> Signup and view all the answers

    What is the primary reason why users tend to dislike retina scans?

    <p>They are not user-friendly</p> Signup and view all the answers

    What is the main difference between environmental errors and configuration errors?

    <p>Environmental errors are caused by system flaws, while configuration errors are caused by user interactions</p> Signup and view all the answers

    Which of the following is NOT a type of error that can occur in a system?

    <p>Syntax error</p> Signup and view all the answers

    What is the primary goal of the Bell-LaPadula model?

    <p>To protect sensitive information from unauthorized access</p> Signup and view all the answers

    What is the purpose of security labels in the Bell-LaPadula model?

    <p>To classify objects based on their sensitivity level</p> Signup and view all the answers

    Which of the following is a characteristic of the Biba model?

    <p>It has the 'no read down' integrity rule</p> Signup and view all the answers

    What type of controls are encryption and access control considered as?

    <p>Logical controls</p> Signup and view all the answers

    What is the term for having more computer rights, permissions, and access than required?

    <p>Excessive Privileges</p> Signup and view all the answers

    What information do sensitivity labels attached to objects contain in Mandatory Access Control?

    <p>The item's classification and category set</p> Signup and view all the answers

    What is the primary purpose of logical controls like encryption and access control?

    <p>To prevent security breaches</p> Signup and view all the answers

    What is the primary focus of the Bell-LaPadula model?

    <p>Confidentiality</p> Signup and view all the answers

    What is the purpose of security labels in the Bell-LaPadula model?

    <p>To classify objects</p> Signup and view all the answers

    What is the primary goal of the Bell-LaPadula model?

    <p>To prevent unauthorized access</p> Signup and view all the answers

    What is the relationship between subjects and objects in the Bell-LaPadula model?

    <p>Subjects have read access to objects</p> Signup and view all the answers

    What is the primary focus of white-box testing?

    <p>To exercise paths through the code and determine the appropriate outputs</p> Signup and view all the answers

    What is the main difference between alpha and beta testing?

    <p>Alpha testing is performed by internal users, while beta testing is performed by external users</p> Signup and view all the answers

    What is the purpose of pilot testing?

    <p>To provide a limited evaluation of the system</p> Signup and view all the answers

    What is the last stage of testing before a product is considered finished?

    <p>Beta testing</p> Signup and view all the answers

    What type of testing involves exercising paths through the code and determining the appropriate outputs?

    <p>White-box testing</p> Signup and view all the answers

    What is an advantage of white-box testing?

    <p>It can uncover many errors or problems</p> Signup and view all the answers

    What is the primary difference between an alpha version and a beta version?

    <p>An alpha version is for internal users, while a beta version is for external users</p> Signup and view all the answers

    What is the purpose of proof of concept in testing?

    <p>To provide a limited evaluation of the system</p> Signup and view all the answers

    Which type of access control is characterized by the restriction of access to systems and the protection of information?

    <p>Logical or Technical Controls</p> Signup and view all the answers

    What is an example of a logical or technical control?

    <p>Encryption</p> Signup and view all the answers

    What is the primary purpose of logical or technical controls?

    <p>To restrict access to systems and protect information</p> Signup and view all the answers

    Which of the following is NOT an example of a logical or technical control?

    <p>Policies and procedures</p> Signup and view all the answers

    What is the primary focus of logical or technical controls in terms of access control?

    <p>Restriction of access to systems</p> Signup and view all the answers

    What is the primary mechanism used by logical or technical controls to protect information?

    <p>Encryption</p> Signup and view all the answers

    What is the main difference between logical or technical controls and other types of access control?

    <p>They involve the restriction of access to systems and the protection of information</p> Signup and view all the answers

    What is the primary benefit of using logical or technical controls to protect information?

    <p>They provide an additional layer of security</p> Signup and view all the answers

    What is the main purpose of a security model in enforcing a security policy?

    <p>To map abstract security goals to information system terms</p> Signup and view all the answers

    What is the primary focus of the Bell-LaPadula model?

    <p>Confidentiality of information</p> Signup and view all the answers

    What determines the handling procedures for classified information in a multilevel security system?

    <p>The object's classification level</p> Signup and view all the answers

    What is used to determine if subjects can access different objects in the Bell-LaPadula model?

    <p>Matrix and security levels</p> Signup and view all the answers

    What is the relationship between subjects and objects in the Bell-LaPadula model?

    <p>Subjects can access objects with a lower classification level</p> Signup and view all the answers

    What is the purpose of a security policy in a multilevel security system?

    <p>To establish the abstract security goals of the system</p> Signup and view all the answers

    What is the benefit of using a security model in system design?

    <p>It provides a mathematical framework for system specifications</p> Signup and view all the answers

    What is the primary goal of a security model in enforcing a security policy?

    <p>To enforce the security policy through explicit data structures and techniques</p> Signup and view all the answers

    What is the Failed Acceptance Rate (FAR) measuring?

    <p>The rate at which attempts by unauthorized users are incorrectly accepted as valid</p> Signup and view all the answers

    What is the relationship between Failed Rejection Rate (FRR) and Failed Acceptance Rate (FAR)?

    <p>As FRR increases, FAR decreases</p> Signup and view all the answers

    What is the Cross-over Error Rate (CER) also known as?

    <p>Equal Error Rate (EER)</p> Signup and view all the answers

    What type of error occurs when a valid user is rejected by the system?

    <p>False Rejection Rate</p> Signup and view all the answers

    What is the purpose of the Cross-over Error Rate (CER)?

    <p>To measure the accuracy of a biometric system</p> Signup and view all the answers

    What is the relationship between the Failed Rejection Rate (FRR) and the Cross-over Error Rate (CER)?

    <p>FRR is equal to CER</p> Signup and view all the answers

    What is the importance of the Cross-over Error Rate (CER) in biometric systems?

    <p>It measures the accuracy of a biometric system</p> Signup and view all the answers

    What is the purpose of the DROP command in a database?

    <p>To remove entire database objects from the DBMS</p> Signup and view all the answers

    What is the purpose of biometric systems?

    <p>To provide authentication</p> Signup and view all the answers

    What is the primary function of the INSERT command in SQL?

    <p>To add a new record to an existing table</p> Signup and view all the answers

    What is the most commonly used command in SQL?

    <p>SELECT</p> Signup and view all the answers

    What does the 'null' keyword indicate in a database field?

    <p>The field can be empty or contain no value</p> Signup and view all the answers

    What is the purpose of the Data Definition Language (DDL)?

    <p>To define the structure of a database</p> Signup and view all the answers

    What is the purpose of the Data Manipulation Language (DML)?

    <p>To retrieve, insert, and modify database information</p> Signup and view all the answers

    What is the purpose of the command 'DROP TABLE personal_info'?

    <p>To remove the entire personal_info table from the database</p> Signup and view all the answers

    What is the purpose of the command 'DROP DATABASE employees'?

    <p>To remove the entire employees database from the DBMS</p> Signup and view all the answers

    What is the primary factor considered when implementing mandatory access control?

    <p>Security clearance</p> Signup and view all the answers

    What protocol was used by the initial version of the Terminal Access Controller Access Control System (TACACS) for communication between clients and servers?

    <p>UDP</p> Signup and view all the answers

    What type of access control is based on labels, which indicate a subject's clearance?

    <p>Mandatory access control</p> Signup and view all the answers

    What is the primary purpose of the Terminal Access Controller Access Control System (TACACS)?

    <p>To authenticate and authorize access to resources</p> Signup and view all the answers

    What is the default port used by TACACS for communication between clients and servers?

    <p>Port 49</p> Signup and view all the answers

    What is the primary advantage of using mandatory access control?

    <p>Improved security due to clearance-based access</p> Signup and view all the answers

    What is the primary difference between the initial and extended versions of TACACS?

    <p>Level of functionality</p> Signup and view all the answers

    What is the purpose of the TACACS daemon or TACACSD?

    <p>To determine whether to accept or deny authentication requests</p> Signup and view all the answers

    What is the primary purpose of authentication in an access control system?

    <p>To verify the claimed identity of a user</p> Signup and view all the answers

    What type of access control is used to specify rules of acceptable behavior in an organization?

    <p>Preventive Access Control</p> Signup and view all the answers

    What is the term for testing internal structures or workings of an application?

    <p>White-box testing</p> Signup and view all the answers

    What is the primary goal of the Bell-LaPadula model?

    <p>To ensure confidentiality of sensitive data</p> Signup and view all the answers

    What is the purpose of security labels in the Bell-LaPadula model?

    <p>To specify the level of access to a resource</p> Signup and view all the answers

    What is the term for having more computer rights, permissions, and access than required?

    <p>Privilege escalation</p> Signup and view all the answers

    What is the primary purpose of views in a database?

    <p>To simplify complex queries</p> Signup and view all the answers

    What is a characteristic of the Biba model?

    <p>It is used to implement integrity controls on data</p> Signup and view all the answers

    What is the primary purpose of using physical attributes or behavior in biometric identification systems?

    <p>To accurately identify individuals</p> Signup and view all the answers

    What is the primary consideration when implementing discretionary access control?

    <p>User identity and access rights</p> Signup and view all the answers

    What is the primary mechanism to protect sensitive information after identification?

    <p>Encryption implementation</p> Signup and view all the answers

    What is the relationship between subjects and objects in the Bell-LaPadula model?

    <p>Subjects have read access to objects</p> Signup and view all the answers

    What is the primary objective of the information flow model developed by Dorothy Denning?

    <p>To prevent unauthorized data flow</p> Signup and view all the answers

    What type of error occurs when an application or system is vulnerable due to an unexpected interaction with the operating system or another application?

    <p>Environmental error</p> Signup and view all the answers

    What is the primary goal of protecting data's confidentiality?

    <p>To prevent unauthorized data access</p> Signup and view all the answers

    What is the primary benefit of using identity-based access control?

    <p>It is based on an individual's identity</p> Signup and view all the answers

    What type of vulnerability can occur when a process attempts to store data beyond the boundaries of a fixed-length buffer?

    <p>Buffer Overflow</p> Signup and view all the answers

    What is the definition of a 'System Crash'?

    <p>A system that stops performing its expected function</p> Signup and view all the answers

    Which type of password token involves time synchronization?

    <p>Synchronous dynamic password tokens</p> Signup and view all the answers

    What is the primary consideration when implementing discretionary access control?

    <p>Access control lists</p> Signup and view all the answers

    What is the purpose of security labels in the Bell-LaPadula model?

    <p>To classify objects based on their sensitivity level</p> Signup and view all the answers

    What is the primary goal of the Bell-LaPadula model?

    <p>To preserve the confidentiality and integrity of data</p> Signup and view all the answers

    What type of error occurs when an application or system is vulnerable due to an unexpected interaction with the operating system or another application?

    <p>Environmental error</p> Signup and view all the answers

    What is the term for having more computer rights, permissions, and access than required?

    <p>Overprivilege</p> Signup and view all the answers

    What type of testing is used to determine the effectiveness of a software program's logic?

    <p>White Box Testing</p> Signup and view all the answers

    What is the purpose of regression testing?

    <p>To rerun a portion of a test scenario or test plan</p> Signup and view all the answers

    What is the primary focus of sociability testing?

    <p>To confirm that a new or modified system can operate in its target environment</p> Signup and view all the answers

    What is the purpose of parallel testing?

    <p>To feed test data into two systems and compare the results</p> Signup and view all the answers

    What type of testing is associated with testing components of an information system's 'functional' operating effectiveness?

    <p>Black Box Testing</p> Signup and view all the answers

    What is the primary purpose of function/validation testing?

    <p>To test the functionality of the system against the detailed requirements</p> Signup and view all the answers

    What type of testing is used to test the impact of installing new dynamic link libraries (DLLs) on the desktop environment?

    <p>Sociability Testing</p> Signup and view all the answers

    What is the primary difference between white box testing and black box testing?

    <p>White box testing tests internal structures, while black box testing tests functional operating effectiveness</p> Signup and view all the answers

    Which protocol is used by RADIUS servers to authenticate users?

    <p>CHAP and PAP</p> Signup and view all the answers

    What is the main advantage of using a RADIUS approach to authentication?

    <p>It provides stronger form of authentication</p> Signup and view all the answers

    What type of passwords can RADIUS servers make use of?

    <p>Both dynamic and static passwords</p> Signup and view all the answers

    What is the primary function of a Network Access Server (NAS) in a RADIUS system?

    <p>To act as a client of RADIUS servers</p> Signup and view all the answers

    What is the term RADIUS an acronym for?

    <p>Remote Authentication Dial In User Service</p> Signup and view all the answers

    What type of authentication is possible with RADIUS, using hardware or software tokens?

    <p>Two-factor authentication</p> Signup and view all the answers

    What is the purpose of the token in RADIUS token-based schemes?

    <p>To generate a dynamic password</p> Signup and view all the answers

    What is the document that describes the features and functions of RADIUS?

    <p>RFC 2138</p> Signup and view all the answers

    Which type of controls are used to prevent unauthorized personnel or programs from gaining remote access to computing resources?

    <p>Preventive/Technical</p> Signup and view all the answers

    What is the primary purpose of technical controls in access control?

    <p>To prevent unauthorized access</p> Signup and view all the answers

    What is an example of a technical control used to enforce access control policies?

    <p>Access control software</p> Signup and view all the answers

    What is the primary goal of preventive technical controls?

    <p>To prevent unauthorized access</p> Signup and view all the answers

    Which of the following is an example of a technical control used to prevent unauthorized access?

    <p>Smart cards</p> Signup and view all the answers

    What is the primary purpose of technical controls in access control?

    <p>To prevent unauthorized access</p> Signup and view all the answers

    Which of the following is a characteristic of technical controls?

    <p>They are used to prevent unauthorized access</p> Signup and view all the answers

    What is the primary benefit of using technical controls in access control?

    <p>They prevent unauthorized access</p> Signup and view all the answers

    What is the primary focus of the Bell-LaPadula model in terms of security?

    <p>Data confidentiality and controlled access</p> Signup and view all the answers

    What is the purpose of transition functions in the Bell-LaPadula model?

    <p>To transition from one secure state to another</p> Signup and view all the answers

    What is the main difference between the Bell-LaPadula model and the Biba model?

    <p>One focuses on confidentiality, the other on integrity</p> Signup and view all the answers

    What is the relationship between subjects and objects in the Bell-LaPadula model?

    <p>Subjects have access to objects based on clearance levels</p> Signup and view all the answers

    What is the benefit of using a formal state transition model like the Bell-LaPadula model?

    <p>It proves that a system satisfies security objectives</p> Signup and view all the answers

    What is the purpose of security labels in the Bell-LaPadula model?

    <p>To classify objects based on their sensitivity level</p> Signup and view all the answers

    What is a 'secure state' in the Bell-LaPadula model?

    <p>A state where only permitted access modes are allowed</p> Signup and view all the answers

    What is the primary goal of the Bell-LaPadula model in terms of access control?

    <p>To control access to classified information</p> Signup and view all the answers

    What is the primary consideration when balancing access controls enforced by an organization and system policy with the ability of information owners to determine access?

    <p>The discretionary access control model</p> Signup and view all the answers

    What is the main characteristic of a Limited RBAC architecture?

    <p>User-role mapping within a single application</p> Signup and view all the answers

    What is the primary objective of role-based access control (RBAC)?

    <p>To determine access control authorizations based on job functions</p> Signup and view all the answers

    What is the purpose of the DROP command in SQL?

    <p>To remove entire database objects from the DBMS</p> Signup and view all the answers

    How do objects associated with a role inherit privileges in RBAC?

    <p>Through the privileges assigned to that role</p> Signup and view all the answers

    What is the primary difference between Non-RBAC and Limited RBAC architectures?

    <p>The scope of the role structure</p> Signup and view all the answers

    What is the purpose of the INSERT command in SQL?

    <p>To add new records to a table</p> Signup and view all the answers

    How are access control decisions made in a role-based access control (RBAC) model?

    <p>Based on job function</p> Signup and view all the answers

    What is the purpose of the SELECT command in SQL?

    <p>To retrieve data from a table</p> Signup and view all the answers

    What is the purpose of the 'null' keyword in SQL?

    <p>To allow a column to contain null values</p> Signup and view all the answers

    What is the primary benefit of using groups in role-based access control (RBAC)?

    <p>Simplifying access control strategies</p> Signup and view all the answers

    What is the Data Definition Language (DDL) used for?

    <p>To define the structure of a database</p> Signup and view all the answers

    What is the main advantage of using role-based access control (RBAC) over traditional access control models?

    <p>Simplified access control strategies</p> Signup and view all the answers

    What is the Data Manipulation Language (DML) used for?

    <p>To retrieve, insert, and modify database information</p> Signup and view all the answers

    What is the purpose of the 'money' argument in SQL?

    <p>To store a value in a dollars and cents format</p> Signup and view all the answers

    What is the command to remove the entire 'employees' database?

    <p>DROP DATABASE employees</p> Signup and view all the answers

    What is the primary reason why environmental errors occur in a system?

    <p>Due to an unexpected interaction between an application and the operating system</p> Signup and view all the answers

    Which of the following biometric devices has the highest precision rate?

    <p>Retina scan</p> Signup and view all the answers

    What is the primary difference between environmental errors and configuration errors?

    <p>Environmental errors occur due to an unexpected interaction, while configuration errors occur due to user-controllable settings</p> Signup and view all the answers

    What type of error occurs when an application or system is vulnerable due to an exceptional condition that has arisen?

    <p>Exceptional condition handling error</p> Signup and view all the answers

    What is the primary reason why users tend to dislike retina scans?

    <p>They are not user-friendly and very intrusive</p> Signup and view all the answers

    Which of the following is NOT a type of error that can occur in a system?

    <p>Network error</p> Signup and view all the answers

    What is the primary goal of the system when it is vulnerable due to an exceptional condition that has arisen?

    <p>To minimize the impact of the exceptional condition</p> Signup and view all the answers

    What is the primary difference between an environmental error and an access validation error?

    <p>Environmental errors occur due to an unexpected interaction, while access validation errors occur due to a faulty access control mechanism</p> Signup and view all the answers

    What is the primary purpose of preventive physical controls?

    <p>To prevent unauthorized personnel from entering computing facilities and to protect against natural disasters</p> Signup and view all the answers

    Which of the following is an example of a preventive administrative control?

    <p>Security awareness and technical training</p> Signup and view all the answers

    What is the main goal of site selection as a preventive physical control?

    <p>To select a location that is secure and safe from natural disasters and unauthorized access</p> Signup and view all the answers

    Which of the following is NOT an example of a preventive physical control?

    <p>Procedures for recruiting and terminating employees</p> Signup and view all the answers

    What is the primary purpose of disaster recovery, contingency, and emergency plans as a preventive administrative control?

    <p>To provide a plan for recovering from disasters and emergencies</p> Signup and view all the answers

    Which of the following is an example of a physical control that is used to protect against natural disasters?

    <p>Fire extinguishers</p> Signup and view all the answers

    What is the primary purpose of user registration for computer access as a preventive administrative control?

    <p>To provide a secure way for users to access computers</p> Signup and view all the answers

    Which of the following is a characteristic of preventive administrative controls?

    <p>They are personnel-oriented techniques for controlling people's behavior</p> Signup and view all the answers

    What is the primary purpose of a logon banner for anonymous users?

    <p>To notify users of acceptable use policies</p> Signup and view all the answers

    Which of the following is a characteristic of something you know?

    <p>A password or PIN</p> Signup and view all the answers

    What is the primary purpose of two-factor authentication?

    <p>To provide an additional layer of security</p> Signup and view all the answers

    Which of the following is a type of something you are?

    <p>A fingerprint or facial recognition</p> Signup and view all the answers

    What is the primary benefit of using two-factor authentication?

    <p>Increased security</p> Signup and view all the answers

    Which of the following is NOT a type of authentication factor?

    <p>Something you eat</p> Signup and view all the answers

    What is the primary consideration when implementing biometric authentication?

    <p>Accuracy</p> Signup and view all the answers

    Which of the following is a characteristic of something you have?

    <p>A smartcard or token</p> Signup and view all the answers

    Study Notes

    Views in Databases

    • A view is a relational table that provides abstraction, similar to functions in programming.
    • Views can be nested, aggregating data from other views, making it easier to create lossless join decomposition.
    • Rows available through a view are not sorted, as sets are not sorted by definition.
    • An ORDER BY clause in a view definition is meaningless and not allowed in the SQL standard.

    Testing Methods

    • White-box testing examines the internal structure or working of an application.
    • It tests internal structures or workings of an application, as opposed to its functionality (black-box testing).

    Biometric Identification

    • Biometric identification systems use unique physical attributes or behavior of a person for identification.
    • Implementation of fast, accurate, reliable, and user-acceptable biometric identification systems is already taking place.

    Data Confidentiality

    • Identifying which information is sensitive is the first step in protecting data confidentiality.
    • Installing a firewall, implementing encryption, and reviewing user access rights are subsequent steps.

    Discretionary Access Control (DAC)

    • Identity-based Access Control is a type of DAC that is based on an individual's identity.
    • Other types of DAC include Rule-based Access Control, Non-Discretionary Access Control, and Lattice-based Access Control.

    Bell-LaPadula Model

    • The Bell-LaPadula model is a formal state transition model of computer security policy that describes a set of access control rules.
    • It focuses on data confidentiality and controlled access to classified information.
    • The model is built on the concept of a state machine with a set of allowable states in a computer network system.

    Lattice-Based Access Control

    • Lattice-Based Access Control (LBAC) is a complex access control model based on the interaction between objects and subjects.
    • A lattice is used to define the levels of security that an object may have and that a subject may have access to.

    Two-Factor Authentication

    • Two-factor authentication requires two independent proofs of identity, such as something the user has and something the user knows.
    • It may be used with single sign-on technology.

    Access Control Categories

    • One of the seven types of Access Control Categories is designed to specify rules of acceptable behavior in an organization.

    Exceptional Condition Handling Error

    • An exceptional condition handling error occurs when a system becomes vulnerable due to an unexpected condition that arises.

    Biometric Devices

    • Retina scan has the lowest user acceptance level among biometric devices due to its invasive nature.
    • Retina scan is the most precise with an error rate of about one per 10 million usages.

    Technical Controls

    • Technical controls, also known as logical controls, can be built into the operating system, be software applications, or supplemental hardware/software units.
    • Examples of technical controls include encryption, smart cards, access lists, and transmission protocols.

    Excessive Privileges

    • Excessive privileges occur when a user has more computer rights, permissions, and access than necessary for their tasks.
    • This is a common security issue that is hard to control in large environments.

    Mandatory Access Control

    • In Mandatory Access Control, sensitivity labels attached to objects contain the item's classification and category set.

    White-Box Testing

    • White-box testing involves an internal perspective of the system and programming skills to design test cases.
    • It can be applied at unit, integration, and system levels of the software testing process.

    Alpha and Beta Testing

    • Alpha testing is performed only by internal users and may not contain all the features planned for the final version.
    • Beta testing is a form of user acceptance testing, involving a limited number of external users and is the last stage of testing.

    Pilot Testing

    • Pilot testing is a preliminary test that focuses on specific and predefined aspects of a system.
    • It is not meant to replace other testing methods, but rather to provide a limited evaluation of the system.

    Security Models

    • A security model maps abstract goals of the policy to information system terms by specifying explicit data structures and techniques necessary to enforce the security policy.
    • The Bell-LaPadula model is a state machine model that enforces the confidentiality aspects of access control.

    Kerberos

    • Kerberos addresses the confidentiality and integrity of information, but does not address availability.

    Biometric Method Accuracy

    • Measured in terms of Failed Acceptance Rate (FAR) and Failed Rejection Rate (FRR)
    • Both expressed as percentages
    • FAR: rate at which attempts by unauthorized users are incorrectly accepted as valid
    • FRR: rate at which authorized users are denied access
    • The Cross-over Error Rate (CER) is the point at which the FRR and the FAR have the same value
    • CER is also called the Equal Error Rate (EER)

    Host-Based IDS

    • Resident on each of the critical hosts
    • Not decentralized or central hosts

    Data Definition Language (DDL)

    • Used to create and modify database structures
    • Includes commands such as DROP, which removes entire database objects
    • Be careful when using DROP, as it removes entire data structures

    Data Manipulation Language (DML)

    • Used to retrieve, insert, and modify database information
    • Includes commands such as INSERT, SELECT, and DELETE
    • INSERT: adds records to an existing table
    • SELECT: retrieves data from a database

    Access Control Models

    • Mandatory Access Control (MAC): requires security clearance for subjects
    • Identity-based access control: a type of discretionary access control
    • Role-based access control: a type of non-discretionary access control

    Terminal Access Controller Access Control System (TACACS)

    • Used for communication between clients and servers
    • Originally used UDP, but was extended to use TCP
    • Defined in RFC 1492, uses port 49 by default

    Biometric Identification

    • Uses unique physical attributes or behavior of a person for identification
    • Implemented to provide fast, accurate, reliable, and user-acceptable identification

    Protecting Data Confidentiality

    • First step: identify which information is sensitive
    • Implement encryption and review user access rights to protect the data

    Discretionary Access Control (DAC)

    • Identity-based access control: a type of DAC that is based on an individual's identity

    Authentication

    • Verification that the user's claimed identity is valid
    • Usually implemented through a user password at log-on time

    IS Audit

    • Race condition: a technique that an attacker could use to force authorization step before authentication

    Buffer Overflow

    • A condition where a process attempts to store data beyond the boundaries of a fixed-length buffer
    • Can be exploited if no data input validation is in place within the software
    • Can lead to a system crash

    System Crash

    • A condition where a program stops performing its expected function and stops responding to other parts of the system
    • Can be the result of exploit code being launched against the target

    Password Tokens

    • Types of password tokens include static, synchronous dynamic, asynchronous dynamic, and challenge-response tokens
    • Synchronous dynamic password tokens generate a new unique password value at fixed time intervals, requiring synchronization with the server
    • Example: Time-based one-time passwords

    Software Testing

    • Types of testing include:
      • White box testing: assesses the effectiveness of a software program's logic
      • Black box testing: tests components of an information system's functional operating effectiveness
      • Function/validation testing: tests the functionality of a system against detailed requirements
      • Regression testing: reruns test scenarios to ensure changes or corrections haven't introduced new errors
      • Parallel testing: feeds test data into two systems to compare results
      • Sociability testing: confirms new or modified systems can operate in their target environment without adverse impact

    Authentication

    • RADIUS (Remote Authentication Dial In User Service) is an Internet protocol that carries authentication, authorization, and configuration information
    • RADIUS incorporates an authentication server and can use both dynamic and static passwords
    • Dynamic passwords are used in token-based schemes, generating a unique access number synchronized with the security server

    Access Control

    • Preventive technical controls use technology to enforce access control policies
    • Examples of preventive technical controls include:
      • Access control software
      • Antivirus software
      • Library control systems
      • Passwords
      • Smart cards
      • Encryption
      • Dial-up access control and callback systems

    Exceptional Condition Handling Error

    • An exceptional condition handling error occurs when a system becomes vulnerable due to an unexpected situation.

    Biometric Devices

    • Retina scan has the lowest user acceptance level, as it is invasive and requires users to get close to a device.
    • Retina scan is the most precise with an error rate of about one per 10 million uses.

    Access Control Models

    • There are three general access control frameworks: Discretionary access control (DAC), Mandatory access control (MAC), and Nondiscretionary access control.
    • Role-Based Access Control (RBAC) bases access control authorizations on user roles within an organization.
    • Access control decisions are based on job function, governed by policy, and each role has its own access capabilities.
    • Objects associated with a role inherit privileges assigned to that role.

    RBAC Architectures

    • There are four basic RBAC architectures: Non-RBAC, Limited RBAC, and two others.
    • Non-RBAC involves traditional user-granted access to data or applications without formal roles.
    • Limited RBAC involves mapping users to roles within a single application.

    Data Definition Language (DDL)

    • DDL is used to create and modify database structures.
    • The DROP command is used to remove entire database objects from a DBMS.
    • Use the DROP command with care, as it permanently removes data structures.

    Data Manipulation Language (DML)

    • DML is used to retrieve, insert, and modify database information.
    • Basic DML commands include INSERT, SELECT, and others.

    Physical Controls

    • Preventive physical controls are employed to prevent unauthorized personnel from entering computing facilities.
    • Examples of physical controls include backup files, fences, security guards, badge systems, and locks.

    Administrative Controls

    • Preventive administrative controls are personnel-oriented techniques for ensuring the confidentiality, integrity, and availability of computing data and programs.
    • Examples of administrative controls include security awareness, separation of duties, procedures for recruiting and terminating employees, and disaster recovery plans.

    Session Monitoring

    • The most appropriate way to notify internal users of session monitoring is through a written agreement.
    • Logon banners can serve as a constant reminder for internal users.

    Two-Factor Authentication

    • A two-factor authentication mechanism relies on two different kinds of authentication factors.
    • The three possible categories of factors are: something you know (e.g., a PIN or password), something you have (e.g., a smart card), and something you are (e.g., biometrics).
    • Something you do (e.g., signature dynamics) is a subset of something you are.

    Studying That Suits You

    Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

    Quiz Team

    Related Documents

    Cissp-8sn2bm.pdf

    Description

    This quiz is about database views, how they provide abstraction, and their role in normalizing databases. It covers topics like nested views and lossless join decomposition.

    More Like This

    SQL Advanced Features: Complex Queries and Views
    0 questions

    SQL Advanced Features: Complex Queries and Views

    EnoughPrudence avatar
    EnoughPrudence
    Database Views and Access SQL
    12 questions

    Database Views and Access SQL

    HealthyZinnia avatar
    HealthyZinnia
    Database Views
    10 questions

    Database Views

    RightfulRhyme avatar
    RightfulRhyme
    Database Views and Semantic Constraints
    8 questions

    Database Views and Semantic Constraints

    EfficientMountRushmore avatar
    EfficientMountRushmore
    Use Quizgecko on...
    Browser
    Open
    Browser
    Browser