ISAC Access Control and Authentication 3 — Questions and Answers
Question 1: Under the Role-Based Access Control (RBAC) model, access permissions are assigned to:
- Individual users based on manager approval
- Roles, which are then assigned to users (Correct answer)
- Data objects based on sensitivity classification
- Network segments based on IP address ranges
Correct answer: Roles, which are then assigned to users
RBAC assigns permissions to roles (e.g., 'auditor,' 'administrator'), and users inherit permissions by being assigned to one or more roles.
Question 2: What does the principle of least privilege require?
- Users must use the weakest authentication method that still meets policy
- Subjects are granted only the minimum permissions necessary to perform their tasks (Correct answer)
- All users in the same department share identical access rights
- Privileged accounts must be used for all administrative actions
Correct answer: Subjects are granted only the minimum permissions necessary to perform their tasks
Least privilege limits each user or process to only the rights required for their legitimate function, reducing the attack surface.
Question 3: A security policy prevents any single employee from being able to both initiate and approve a financial transaction. This is an example of:
- Least Privilege
- Need to Know
- Separation of Duties (Correct answer)
- Job Rotation
Correct answer: Separation of Duties
Separation of duties splits critical tasks among multiple individuals to prevent fraud and errors by ensuring no single person controls an entire process.
Question 4: Which protocol is commonly used to centralize authentication for dial-up and wireless network access, using UDP and a shared secret between the client and server?
- LDAP
- Kerberos
- RADIUS (Correct answer)
- SAML
Correct answer: RADIUS
RADIUS (Remote Authentication Dial-In User Service) centralizes authentication, authorization, and accounting for network access using UDP and a shared secret.
Question 5: In a zero-trust security model, which assumption about network traffic is foundational?
- Internal network traffic is always trusted
- All traffic, regardless of origin, must be verified before access is granted (Correct answer)
- Perimeter firewalls provide sufficient protection for internal resources
- Authenticated users should have broad access to improve productivity
Correct answer: All traffic, regardless of origin, must be verified before access is granted
Zero trust operates on 'never trust, always verify,' requiring all traffic — even from inside the corporate network — to be authenticated and authorized.
Question 6: What is a 'federation' in the context of identity management?
- A centralized database of all user credentials across an organization
- A trust relationship that allows identities from one domain to access resources in another (Correct answer)
- A method for encrypting authentication tokens during transmission
- A hardware appliance that manages physical access badges
Correct answer: A trust relationship that allows identities from one domain to access resources in another
Identity federation establishes a trust relationship between separate identity providers, enabling users from one organization to access resources in another without separate credentials.
Question 7: An attacker captures a valid authentication token and replays it to gain unauthorized access. What type of attack is this?
- Man-in-the-Middle Attack
- Replay Attack (Correct answer)
- Pass-the-Hash Attack
- Credential Stuffing
Correct answer: Replay Attack
A replay attack involves capturing a valid authentication message or token and retransmitting it to impersonate the legitimate user.
ISAC Access Control and Authentication 3
Under the Role-Based Access Control (RBAC) model, access permissions are assigned to: