Technology & Tools Flashcards

Which RADIUS capability makes it widely used for network access authentication?

Answer: Centralized AAA for VPN, Wi-Fi, and network devices

RADIUS provides centralized authentication, authorization, and accounting for network access.

What is the key difference between TACACS+ and RADIUS?

Answer: TACACS+ separates authentication, authorization, and accounting and encrypts the full packet body

TACACS+ runs over TCP, decouples the AAA functions, and encrypts the whole body, favored for device administration.

Which concept allows a user to maintain a single set of credentials across multiple systems, with each system still authenticating separately?

Answer: Same sign-on

Same sign-on uses identical credentials but requires re-authentication per system, unlike true SSO.

A service account used by an application should ideally be managed how?

Answer: Vaulted with automated rotation and least privilege

Service accounts should be inventoried, vaulted, rotated, and limited to required permissions.

Which technology uses attributes of the user, resource, and environment to make access decisions at runtime?

Answer: Attribute-based access control

ABAC evaluates policies over subject, resource, action, and environment attributes dynamically.

What is a primary benefit of using a hardware security module (HSM) in an identity infrastructure?

Answer: Tamper-resistant protection of private keys such as CA or token signing keys

HSMs store and use cryptographic keys inside hardened hardware, protecting signing keys from extraction.

In a PKI used for identity, what does an OCSP responder do?

Answer: Reports the revocation status of a certificate in real time

OCSP lets relying parties check whether a specific certificate has been revoked without downloading a full CRL.