ISAC Access Control and Authentication 1 — Questions and Answers
Question 1: What is the principle of "least privilege"?
- Users should only have access to the systems they use most frequently.
- Users should be granted the minimum level of access necessary to perform their job. (Correct answer)
- Users should have access to all resources for greater efficiency.
- Access permissions should expire after a set period of inactivity.
Correct answer: Users should be granted the minimum level of access necessary to perform their job.
The principle of least privilege (PoLP) is a fundamental security concept that dictates users, programs, and processes should only have the bare minimum permissions required to perform their legitimate functions. This minimizes the potential damage if an account is compromised, as an attacker would only gain access to a limited set of resources. It reduces the attack surface and helps contain breaches.
Question 2: Which of the following is an example of multi-factor authentication (MFA)?
- Using a password and a security question
- Using a password and a fingerprint scanner (Correct answer)
- Using two different passwords
- Using an access card only
Correct answer: Using a password and a fingerprint scanner
Multi-factor authentication (MFA) enhances security by requiring users to provide two or more verification factors from different categories to gain access. These categories typically include something you know (like a password), something you have (like a phone or security token), and something you are (like a fingerprint or facial scan). A password and a fingerprint scanner combine "something you know" with "something you are," fulfilling the MFA requirement.
Question 3: What is a strong password policy?
- Requiring users to change their passwords monthly
- Requiring passwords to be at least 8 characters long, with a mix of letters, numbers, and symbols (Correct answer)
- Allowing users to reuse old passwords
- Requiring passwords to contain only letters and numbers
Correct answer: Requiring passwords to be at least 8 characters long, with a mix of letters, numbers, and symbols
A strong password policy is essential for protecting accounts from brute-force attacks and dictionary attacks. Requiring a minimum length, typically 8-12 characters or more, combined with a mix of uppercase and lowercase letters, numbers, and special symbols, significantly increases the complexity and entropy of a password. This makes it much harder for attackers to guess or crack.
Question 4: What does two-factor authentication (2FA) protect against?
- Unauthorized access from compromised credentials (Correct answer)
- Data loss during a system failure
- Network downtime caused by a DDoS attack
- Malware infection on a device
Correct answer: Unauthorized access from compromised credentials
Two-factor authentication (2FA) adds an extra layer of security beyond just a password. Even if an attacker manages to steal a user's password (e.g., through phishing), they would still need the second factor (like a code from a phone or a fingerprint) to gain access. This significantly reduces the risk of unauthorized access even if the primary credentials are compromised.
Question 5: Why is it important to disable unused user accounts promptly?
- To reduce clutter in the system
- To free up storage space
- To prevent unauthorized access through dormant accounts (Correct answer)
- To improve system performance
Correct answer: To prevent unauthorized access through dormant accounts
Unused or dormant user accounts pose a significant security risk because they are often forgotten, unmonitored, and may retain elevated privileges. If an attacker compromises such an account, they could gain unauthorized access to the system or network without detection. Promptly disabling or deleting these accounts removes potential entry points for malicious actors, strengthening overall security posture.
ISAC Access Control and Authentication 1
What is the principle of "least privilege"?