Free Data Warehousing on AWS: Security and Access Control Questions and Answers — Questions and Answers
Question 1: Which access control model has non-mandatory labels and allows the resource owner to set privileges to the data they own?
- BAC
- RBAC
- MAC
- DAC (Correct answer)
Correct answer: DAC
Discretionary Access Control (DAC) is an access control model where the owner of a resource can grant or revoke access permissions to other users. It is characterized by its flexibility, as access decisions are at the discretion of the resource owner, and it does not typically involve mandatory labels like MAC.
Question 2: Which of the subsequent authentication techniques is the most straightforward?
- Kerberos
- PAP (Correct answer)
- Security token
- CHAP
Correct answer: PAP
Password Authentication Protocol (PAP) is considered the most straightforward authentication technique because it sends usernames and passwords in clear text over the network. While simple to implement, this lack of encryption makes it highly vulnerable to eavesdropping and is generally not recommended for secure environments.
Question 3: Which access control model utilizes a fixed set of access rights to files on the system and is static?
- BRACK
- RBAC
- MAC (Correct answer)
- DAC
Correct answer: MAC
Mandatory Access Control (MAC) is an access control model where access rights are determined by system-wide security policies, not by the resource owner. It uses security labels (sensitivity levels) assigned to subjects and objects, and access is granted only if the subject's clearance level meets or exceeds the object's classification. This model is static and highly structured.
Question 4: Which of the following authentication protocols issues a ticket to the principal (a user, system, program, etc.) after authenticating it?
- Kerberos (Correct answer)
- PAP
- Security token
- CHAP
Correct answer: Kerberos
Kerberos is a widely used network authentication protocol that provides strong authentication for client/server applications by using secret-key cryptography. After a principal (user or service) authenticates to the Kerberos server, it is issued a ticket, which it then uses to request services from other servers without re-authenticating.
Question 5: Which of the following authentication protocols uses an encrypted challenge and challenges a system to confirm identity?
- Kerberos
- PAP
- Security token
- CHAP (Correct answer)
Correct answer: CHAP
Challenge-Handshake Authentication Protocol (CHAP) is an authentication protocol that periodically verifies the identity of a peer using a three-way handshake. It does not send the password over the network but instead uses a challenge-response mechanism with a one-way hash, making it more secure than PAP.
Question 6: Which of the following access threats entails someone browsing your files in search of something intriguing?
- Active interception
- Eavesdropping
- Passive interception
- Snooping (Correct answer)
Correct answer: Snooping
Snooping refers to the act of unauthorized browsing or searching through someone's files or data without their knowledge or permission, typically in a passive manner. It's a form of passive interception where the attacker is looking for interesting or sensitive information rather than actively altering data.
Question 7: Which of the following doesn't constitute a legitimate access control model?
- BAC (Correct answer)
- RBAC
- MAC
- DAC
Correct answer: BAC
Among the given options, BAC (which doesn't stand for a recognized access control model) is not a legitimate access control model. The widely recognized and implemented access control models are Discretionary Access Control (DAC), Mandatory Access Control (MAC), and Role-Based Access Control (RBAC).
Question 8: Which access control model enables a person, based on the position they have within the company, to behave in a specific specified manner?
- SAC
- RBAC (Correct answer)
- MAC
- DAC
Correct answer: RBAC
Role-Based Access Control (RBAC) assigns permissions to users based on their roles within an organization. Instead of assigning permissions directly to individual users, permissions are granted to roles, and users are then assigned to appropriate roles. This simplifies management and ensures users have access consistent with their job functions.
Question 9: Which of the following uses port 389 as an X.500 implementation?
- XML
- XNS
- LDAP (Correct answer)
- X.502
Correct answer: LDAP
Lightweight Directory Access Protocol (LDAP) is an open, vendor-neutral, industry-standard application protocol for accessing and maintaining distributed directory information services. It is an implementation of the X.500 standard and commonly uses port 389 for unencrypted communication and port 636 for encrypted communication (LDAPS).
Question 10: Which of the following must be different for every object in Active Directory?
- DN (Correct answer)
- UPN
- CN
- RDN
Correct answer: DN
In Active Directory, a Distinguished Name (DN) uniquely identifies an object within the directory. Every object, whether it's a user, group, or computer, must have a unique DN to ensure it can be precisely located and referenced within the hierarchical structure of the directory.
Question 11: Which of the following is not a protocol used by Microsoft?
- WINS
- NetBEUI
- NetBIOS
- NFS (Correct answer)
Correct answer: NFS
Network File System (NFS) is a distributed file system protocol originally developed by Sun Microsystems, primarily used in Unix-like operating systems to allow users to access files over a network. WINS, NetBEUI, and NetBIOS are protocols or services more closely associated with Microsoft networking environments.
Question 12: Which of the following names has the distinctive part that is specific to the container?
- DN
- UPN
- CN
- RDN (Correct answer)
Correct answer: RDN
The Relative Distinguished Name (RDN) is the most specific component of a Distinguished Name (DN) and is unique within its parent container. For example, in 'CN=John Doe,OU=Users,DC=example,DC=com', 'CN=John Doe' is the RDN, uniquely identifying John Doe within the 'Users' Organizational Unit.
Question 13: The friendly name for which of the following is it most common to use?
- DN
- UPN (Correct answer)
- CN
- RDN
Correct answer: UPN
The User Principal Name (UPN) is a user-friendly name for a user account in Active Directory, typically in the format `username@domain.com`. It is often used for logging on to a Windows domain and is designed to be easily remembered and recognized by users, unlike the more complex Distinguished Name (DN).
Question 14: Out of the following LDAP/Active Directory names, which one is a distinguished name according to top-down notation?
- NDP
- UPN
- CN (Correct answer)
- RDN
Correct answer: CN
The Common Name (CN) is a component of a Distinguished Name (DN) that represents the name of the object itself within its immediate container. In top-down notation for LDAP/Active Directory, the CN is the most specific part of the DN, representing the object's 'friendly' name before listing its parent containers.
Question 15: The Novell directory management service that took the place of NDS is which of the following?
- Registry
- ZENworks
- EDirectory (Correct answer)
- DNS
Correct answer: EDirectory
Novell eDirectory is a software-based directory service developed by Novell (now Micro Focus) that succeeded Novell Directory Services (NDS). It provides a centralized, secure repository for managing network resources, users, and applications across various platforms. EDirectory offers advanced features like multi-master replication and robust security, making it a comprehensive identity management solution.
Question 16: Which of the following is the default networking protocol for computers running Windows?
- NFS
- NetBEUI
- NetBIOS (Correct answer)
- IPX/SPX
Correct answer: NetBIOS
NetBIOS (Network Basic Input/Output System) was historically the default networking protocol for Windows computers, particularly in older versions and for local area network (LAN) communication. While modern Windows systems primarily use TCP/IP, NetBIOS over TCP/IP (NetBT) is still often enabled for backward compatibility and name resolution services within local networks. It provides services for session management and name resolution for applications.
Free Data Warehousing on AWS: Security and Access Control Questions and Answers
Which access control model has non-mandatory labels and allows the resource owner to set privileges to the data they own?