ISAC Access Control and Authentication 3

Question 1

Under the Role-Based Access Control (RBAC) model, access permissions are assigned to:

Accepted Answer

Roles, which are then assigned to users

Answer

RBAC assigns permissions to roles (e.g., 'auditor,' 'administrator'), and users inherit permissions by being assigned to one or more roles.

Question 2

What does the principle of least privilege require?

Accepted Answer

Subjects are granted only the minimum permissions necessary to perform their tasks

Answer

Least privilege limits each user or process to only the rights required for their legitimate function, reducing the attack surface.

Question 3

A security policy prevents any single employee from being able to both initiate and approve a financial transaction. This is an example of:

Accepted Answer

Separation of Duties

Answer

Separation of duties splits critical tasks among multiple individuals to prevent fraud and errors by ensuring no single person controls an entire process.

Question 4

Which protocol is commonly used to centralize authentication for dial-up and wireless network access, using UDP and a shared secret between the client and server?

Accepted Answer

RADIUS

Answer

RADIUS (Remote Authentication Dial-In User Service) centralizes authentication, authorization, and accounting for network access using UDP and a shared secret.

Question 5

In a zero-trust security model, which assumption about network traffic is foundational?

Accepted Answer

All traffic, regardless of origin, must be verified before access is granted

Answer

Zero trust operates on 'never trust, always verify,' requiring all traffic — even from inside the corporate network — to be authenticated and authorized.

(ISAC) International Society for the Advancement of Cytometry Practice Test

(ISAC) International Society for the Advancement of Cytometry Practice Test

ISAC Access Control and Authentication 3