ISAC Access Control and Authentication 2 — Questions and Answers
Question 1: Which authentication protocol uses tickets issued by a Key Distribution Center (KDC) to grant access to network services?
- RADIUS
- Kerberos (Correct answer)
- LDAP
- TACACS+
Correct answer: Kerberos
Kerberos uses a KDC that issues Ticket-Granting Tickets (TGTs) and service tickets to authenticate users without repeatedly sending credentials.
Question 2: What is the primary difference between identification and authentication?
- Identification grants access; authentication logs the event
- Identification claims an identity; authentication proves that identity (Correct answer)
- Authentication claims an identity; identification verifies permissions
- They are interchangeable terms in access control
Correct answer: Identification claims an identity; authentication proves that identity
Identification is the act of claiming an identity (e.g., providing a username), while authentication is proving that claim (e.g., providing a correct password).
Question 3: A user logs into a corporate portal once and gains access to email, HR systems, and project tools without re-entering credentials. This describes which concept?
- Federated Identity Management
- Single Sign-On (SSO) (Correct answer)
- Mutual Authentication
- Delegated Authorization
Correct answer: Single Sign-On (SSO)
Single Sign-On (SSO) allows a user to authenticate once and access multiple applications without repeated logins.
Question 4: Which of the following best describes a brute-force attack against an authentication system?
- Intercepting authentication tokens in transit
- Systematically trying all possible credential combinations until successful (Correct answer)
- Exploiting session tokens after a valid login
- Sending malformed inputs to bypass credential checks
Correct answer: Systematically trying all possible credential combinations until successful
A brute-force attack exhaustively tries every possible password or key combination until the correct one is found.
Question 5: In the context of multi-factor authentication (MFA), a hardware token that generates a time-based one-time password (TOTP) represents which factor category?
- Something you know
- Something you are
- Something you have (Correct answer)
- Somewhere you are
Correct answer: Something you have
A physical hardware token is a possession-based factor — 'something you have' — because it is a physical device the user must possess.
Question 6: Which access control model assigns permissions based on the sensitivity labels of objects and the security clearances of subjects, with decisions made by the system rather than the owner?
- Discretionary Access Control (DAC)
- Mandatory Access Control (MAC) (Correct answer)
- Role-Based Access Control (RBAC)
- Attribute-Based Access Control (ABAC)
Correct answer: Mandatory Access Control (MAC)
Mandatory Access Control (MAC) uses system-enforced labels and clearances, preventing owners from overriding the policy — common in government and military environments.
Question 7: An organization configures its VPN to require both a password and a certificate installed on the user's registered device. Which security principle does this reinforce?
- Least Privilege
- Defense in Depth
- Multi-Factor Authentication (Correct answer)
- Separation of Duties
Correct answer: Multi-Factor Authentication
Requiring a password (something you know) plus a device certificate (something you have) implements multi-factor authentication, strengthening access security.
ISAC Access Control and Authentication 2
Which authentication protocol uses tickets issued by a Key Distribution Center (KDC) to grant access to network services?