ISAC Access Control and Authentication 3

Question 1

Under the Role-Based Access Control (RBAC) model, access permissions are assigned to:

Accepted Answer

Roles, which are then assigned to users

Answer

Individual users based on manager approval

Answer

Data objects based on sensitivity classification

Answer

Network segments based on IP address ranges

Question 2

What does the principle of least privilege require?

Accepted Answer

Subjects are granted only the minimum permissions necessary to perform their tasks

Answer

Users must use the weakest authentication method that still meets policy

Answer

All users in the same department share identical access rights

Answer

Privileged accounts must be used for all administrative actions

Question 3

A security policy prevents any single employee from being able to both initiate and approve a financial transaction. This is an example of:

Accepted Answer

Separation of Duties

Answer

Least Privilege

Answer

Need to Know

Answer

Job Rotation

Question 4

Which protocol is commonly used to centralize authentication for dial-up and wireless network access, using UDP and a shared secret between the client and server?

Accepted Answer

RADIUS

Answer

LDAP

Answer

Kerberos

Answer

SAML

Question 5

In a zero-trust security model, which assumption about network traffic is foundational?

Accepted Answer

All traffic, regardless of origin, must be verified before access is granted

Answer

Internal network traffic is always trusted

Answer

Perimeter firewalls provide sufficient protection for internal resources

Answer

Authenticated users should have broad access to improve productivity

Question 6

What is a 'federation' in the context of identity management?

Accepted Answer

A trust relationship that allows identities from one domain to access resources in another

Answer

A centralized database of all user credentials across an organization

Answer

A method for encrypting authentication tokens during transmission

Answer

A hardware appliance that manages physical access badges

Question 7

An attacker captures a valid authentication token and replays it to gain unauthorized access. What type of attack is this?

Accepted Answer

Replay Attack

Answer

Man-in-the-Middle Attack

Answer

Pass-the-Hash Attack

Answer

Credential Stuffing