Review Questions

---

1.	Of the following choices, which technique is used to falsify or imitate another user’s identity in order to gain access to a system? Sniffing. Encrypting. Spoofing. Decrypting
2.	Which of the following choices best describes an ACL? Uses a mathematical format to determine if access should be granted. Creates audit messages when protected objects receive access requests. Authentication Clarification List. A table used to identify user access rights assigned to an object.
3.	Which of the following choices is used to unlock a previously encrypted message? Undercover security guard. Certificate Authority. Private key. Public key.
4.	Which of the following choices best defines a password? A token-based authentication mechanism. A knowledge-based authentication mechanism. A characteristic-based authentication mechanism. A physical security authentication mechanism.
5.	Which type of access control technique uses a mathematical formula or lattice to determine whether or not access should be granted to a resource? LBAC. DAC. MAC. RBAC.
6.	Which type of access control technique is discretionary and restricts access to resources based on the identity of users and/or groups? TOBACK. MAC. DAC. TBAC.
7.	Which of the following protocols represent centralized access control? (Choose two) MAC. LBAC. RADIUS. DAC. TACACS.
8.	Which of the following choices best represents a strong password? brians. An7!$4Dt. bob1965. 123abc.
9.	Which of the following represent logical security controls? (Choose two) Antivirus software. Performance assessments. Battery backups. Passwords. Security training.
10.	Which of the following are considered to be Denial of Service (DoS) attack methods? (Choose three) MAC attack. Buffer overflow attack. SYN attack. Smurf attack. Spam attack.
11.	Which attack methods do crackers most commonly use to figure out passwords? Ticket and token attacks. SYN and Smurf attacks. Buffer overflow and spamming attacks. Brute force and dictionary attacks.
12.	Which choice is an “electronic credit card” used to verify one’s identity for Internet or electronic transactions? Digital certificate. Token. Private key. Certificate authority.
13.	Which choice compares the patterns of an attack against a known system footprint before reporting an intrusion? Signature intrusion analysis. Statistical intrusion analysis. TACACS analysis. Event Viewer analysis.
14.	What does a Kerberos ticket do? Analyzes and tests the security of a computing system. Allows users to access physically secured areas. Allows users access to objects. It’s freeware that analyses security holes in a network
15.	Which security model was the first mathematical security model used to address security, modes of access, and a set of rules for assigning security access rights? Biba model. Clark-Wilson model. OSI model. Bell-LaPadula model. Wilson-Phillips model.
16.	Which authentication method requires a user password and a digitally signed certificate to allow access to a system or resource? Mutual. Multi-factor. Single Sign-On. Smart card.
17.	Which type of biometric device is considered to be the most secure? Fingerprint scanner. Signature scanner. Security dog (K9). Retina scanner.

Answers

1.	Correct answer = C Spoofing is used to allow intruders the ability to act or pretend to be an authorized user. Sniffing refers to the gathering of network packets. Encrypting is a conversion process where plain text is converted to cipher text through cryptography algorithms in order to make information secret or unreadable. Decrypting is the process of taking information or data that has been encrypted and transforming or deciphering it into plain text format. Cryptography methods are used for this conversion process.
2.	Correct answer = D An ACL (Access Control List) is a list of access rights that are assigned to an object in a system. The System Access Control List (SACL) creates the audit messages when protected objects receive access requests. The Authentication Clarification List is a trick and does not exist. Lattice-Based Access Control (LBAC) is an access control method that uses a mathematical format to determine if access should be granted to a system.
3.	Correct answer = C A private key is a secret part of a key pair that is used to decrypt or unlock a previously encrypted or locked message. If you picked choice A, please read Chapter 2 again. A certificate authority is a trusted provider or issuing organization that provides and guarantees digital certificates. A public key is the known part of a key pair that is used to encrypt or lock a message.
4.	Correct answer = B A password (which is a knowledge-based authentication method) is typically compared to a security database on a host. If all requirements are met, the user is allowed access. A smart card is a token-based authentication device or mechanism. Retina and fingerprint scanning are characteristic-based authentication mechanisms. Security guards, padlocks, and gates are examples of physical security.
5.	Correct answer = A LBAC uses a mathematical formula, or lattice, to determine whether or not access to a resource should be granted. DAC restricts access to resources based on the identity of users and/or groups of which they are members. This technique is referred to as discretionary because it also allows users to pass on access permissions to other users within the organization. MAC assigns hierarchical, multilevel sensitivity labels to users and data (as in the military—unclassified, confidential, secret, and top secret). RBAC enables organizational planners to put an access control policy into place that the system must abide by, rather than a policy that changes with the whim of a user or administrator.
6.	Correct answer = C Discretionary Access Control restricts access to resources based on the identity of users and/or groups of which they are members. This technique is referred to as discretionary because it also allows users to pass on access permissions to other users within the organization. TOBACK is the last name of a contributor of this book. Mandatory Access Control, also called nondiscretionary, uses a centralized approach to restrict access to data based on the sensitivity of the data in question. TBAC bases its access decisions on the current state of works in progress.
7.	Correct answers = C and E RADIUS is a scalable, client/server-based UDP protocol used to transfer authentication and authorization data between a dial-in client and a server. TACACS is a dated, remote authentication protocol typically implemented on UNIX servers. Both RADIUS and TACACS are protocols that represent centralized access control. MAC, DAC, and LBAC are not protocols; they are access control techniques and models.
8.	Correct answer = B A strong password should be a minimum of seven characters in length. The password should contain a combination of upper- and lowercase letters. There should be at least one number contained in the password. The password should contain at least one of the following characters: ! @#$%^&*. A password should never be a word from a dictionary, a person’s name, family name, phone number, birth date, or favorite phrase. All choices other than B do not meet these criteria.
9.	Correct answers = A and D Logical controls refer to systems such as access control software, antivirus software, communications hardware (routers), passwords, and smart cards. They represent the systems in place that prevent unauthorized access to digitized information. Administrative controls are the personnel-related mechanisms for managing people’s behavior. These include security training, background investigations, mandatory vacations, and performance assessments. Physical controls entail the use of instruments such as locks, fences, motion detectors, battery backups, and burglar/fire alarms. They are the material systems and devices that protect assets from theft, fire, or other means of destruction.
10.	Correct answers = B, C, and D A denial of service attack is designed to render a network or related service useless by flooding the network with worthless or useless network traffic. Buffer overflow, SYN, and Smurf attacks are all designed to meet these criteria. If you chose MAC attack, you are probably hungry and should get something to eat before you continue on with the next chapter. Spam is the proliferation or sending of unsolicited e-mail or electronic advertisements and messages.
11.	Correct answer = D Crackers most commonly use brute force and dictionary attack methods as tools of choice to figure out passwords. Tokens and tickets are used as characteristic-based authentication mechanisms. SYN, Smurf, and buffer overflow attacks are denial of service attack methods used to disable access to a network or service. Spamming attacks are used to send out unsolicited e-mail advertisements and messages.
12.	Correct answer = A A digital certificate is like an electronic credit card used to verify one’s credentials for Internet or e-business transactions. A token is a small credit-card sized security device that contains an ever-changing identification code, which allows its holder to access network resources. A private key is the secret part of a key pair that is used to decrypt or unlock a previously encrypted or locked message. A certificate authority is a trusted provider or issuing organization that provides and guarantees digital certificates.
13.	Correct answer = B Statistical intrusion analysis is the process of establishing a known footprint or baseline of a system’s usage of such things as CPU (central processing unit) utilization, disk utilization, use of user rights, user log-ins, file and folder access over time, and analyzing the system for any deviation from the system’s baseline or “normal” behavior. Signature intrusion analysis uses a method of comparing suspect system activity against a database of known attack method patterns. TACACS analysis and Event Viewer analysis are invalid choices.
14.	Correct answer = C The Kerberos authentication protocol uses a string of encoded messages and the issuance of special tickets to verify the identification of the user in question and allow or disallow a user’s access to objects. Non-interference is designed as a tool for analyzing or testing the security of a computing system. Kerberos has nothing to do with allowing users access to physically secured areas. A computerized or electronic door or gate pass typically provides this function. SATAN is a freeware program that analyses security holes in a network.
15.	Correct answer = D The Bell-LaPadula model was the first mathematical security model used to address security, modes of access, and a set of rules for assigning security access rights. The Biba security model was created to address some of the particular weaknesses in the Bell-LaPadula model. It was not the first model. The Clark-Wilson security model was developed in 1987. Its main focus is to protect the integrity of data through the use of secured programs. The OSI model is a widely accepted seven-layered reference model that identifies how data should flow from one location to another in a computer network. The Wilson-Phillips model is not a valid choice.
16.	Correct answer = B Multi-factor authentication is the combined use of a password as well as a key-exchange system to provide strong authentication. This type of authentication scheme should be implemented when the use of a single sign-on and password or an encrypted key system alone will not be enough security. With mutual authentication, a trust relationship is first established between a host and its intended recipients or clients. Second, digitally signed certificates are typically implemented in order to allow the host or server system to authenticate to the client system. Single Sign-On (SSO) provides a secure way for users to be authenticated just once while enabling enterprise-wide access to data. A smart card is a token-based authentication device that allows its owner to gain access to a particular service such as banking, parking, or gasoline services.
17.	Correct answer = D A retina scanner is currently the most secure biometric device available. Fingerprint devices and signature scanning devices are the most widely accepted forms of biometric implementation. However, they are not as secure as retina scanning devices. Although security dogs can be very faithful and effective, they are not considered to be secure biometric authentication methods.

---