Like this CertiGuide? Get it in PDF format!
Click Here!
Use coupon code "certiguide" to save 20%!
(Expires 2004/12/31)

Also available: 300-question Security+ practice test!
Get It Here!

Custom Search







Table Of Contents  CertiGuide to Security+
 9  Chapter 7:  Practice Exam Answers

Previous Topic/Section
Answers to Questions 1-5
Previous Page
Pages in Current Topic/Section
1
Next Page
Answers to Questions 11-15
Next Topic/Section

Answers to Questions 6-10

6. With _______________, access decisions are based on the roles that individual users have as part of an organization.

A. Role based access control

B. Rule based access control

C. Server based access control

D. Token based access control

Explanation: With role-based access control, access decisions are based on the roles that individual users have as part of an organization. Users take on assigned roles (such as doctor, nurse, teller, manager). The process of defining roles should be based on a thorough analysis of how an organization operates and should include input from a wide spectrum of users in an organization.

Most access control systems are rule-based -- that is, they use a preset list of rules when deciding whether or not a user should have access to a resource; this is not specific to access control systems based on user role. Most networks use server-based access control to control access to network resources, however, local resources are typically under the control of the local machine. Neither is particularly unique to role-based access control. Some networks may use token-based access control, but that is not a requirement for role-based access control, either.

& Section 1.1: Access Control

& Section 5.5.5: MAC/DAC/RBAC

 

7. Which of the following is a feature of the Rule based access control?

A. The use of profiles

B. The use of information flow labels

C. The use of data flow diagrams

D. The use of tokens

Explanation: Rule based access control is based on a specific profile for each user. Information can be easily changed for only one user but this scheme may become a burden in a very large environment. A rule-based access control unit will intercept every request to the server and compare the source specific access conditions with the rights of the user in order to make an access decision. A good example could be a firewall. Here a set of rules defined by the network administrator is recorded in a file. Every time a connection is attempted (incoming or outgoing), the firewall software checks the rules file to see if the connection is allowed. If it is not, the firewall closes the connection.

Information flow labels are usually associated with Mandatory Access Control (MAC). Data flow diagrams are most commonly used in software development, not in rule-based access control. Tokens are usually used for authentication, a function which is important for any type of access control.

& Section 1.1: Access Control

& Section 5.5.5: MAC/DAC/RBAC

 

8. A firewall can be classified as a:

A. Rule based access control

B. Lattice based access control

C. Directory based access control

D. ID based access control

Explanation: Rule based access control is based on a specific profile for each user. Information can be easily changed for only one user but this scheme may become a burden in a very large environment. A rule-based access control unit will intercept every request to the server and compare the source specific access conditions with the rights of the user in order to make an access decision. A good example could be a firewall. Here a set of rules defined by the network administrator is recorded in a file. Every time a connection is attempted (incoming or outgoing), the firewall software checks the rules file to see if the connection is allowed. If it is not, the firewall closes the connection.

Lattice-based access control is associated with Mandatory Access Control (MAC). Directory based and ID based access controls are not relevant.

& Section 1.1: Access Control

 

9. In the Lattice Based Access Control model, controls are applied to:

A. Models

B. Factors

C. Scripts

D. Objects

Explanation: Information flow is clearly central to confidentiality but to some extent it also applies to integrity. The basic work in this area was done around 1970 and was driven mostly by the defense sector. Information flow in computer systems is concerned with flow from one security class (also called security label) to another. These controls are applied to objects. An object is a container of information; an object can be a directory or file.

Controls are part of the Lattice Based Access Control (Mandatory Access Control) model, not applied to the model. Factors and scripts are not involved in the model.

& Section 1.1: Access Control

& Section 5.5.5: MAC/DAC/RBAC

 

10. With Discretionary access controls, who determines who has access and what privilege they have?

A. Resource owners

B. End users

C. Only the administrators

D. No Answer is Correct

Explanation: Discretionary access controls can extend beyond limiting which subjects can gain what type of access to which objects. Administrators can limit access to certain times of day or days of the week. Typically, the period during which access would be permitted is 9 a.m. to 5 p.m. Monday through Friday. Such a limitation is designed to ensure that access takes place only when supervisory personnel are present, to discourage unauthorized use of data. Further, subjects' rights to access might be suspended when they are on vacation or leave of absence. When subjects leave an organization altogether, their rights must be terminated rather than merely suspended. Under this type of control, the owner determines who has access and what privilege they have.

If the end users of resources had control of who had access and what privileges they have, they would be able to access any resource, because they'd have the ability to change access controls at will. If only the administrators controlled access to resources, it would be a major job duty (as well as a bureaucratic bottleneck for users) that would take time away from other administrative activities.

& Section 1.1: Access Control

& Section 5.5.5: MAC/DAC/RBAC


Previous Topic/Section
Answers to Questions 1-5
Previous Page
Pages in Current Topic/Section
1
Next Page
Answers to Questions 11-15
Next Topic/Section

If you find CertiGuide.com useful, please consider making a small Paypal donation to help the site, using one of the buttons below. You can also donate a custom amount using the far right button (not less than $1 please, or PayPal gets most/all of your money!) In lieu of a larger donation, you may wish to consider buying an inexpensive PDF equivalent of the CertiGuide to Security+ from StudyExam4Less.com. (Use coupon code "certiguide" by December 31, 2004 to save 20%!) Thanks for your support!
Donate $2
Donate $5
Donate $10
Donate $20
Donate $30
Donate: $



Home - Table Of Contents - Contact Us

CertiGuide for Security+ (http://www.CertiGuide.com/secplus/) on CertiGuide.com
Version 1.0 - Version Date: November 15, 2004

Adapted with permission from a work created by Tcat Houser et al.
CertiGuide.com Version Copyright 2004 Charles M. Kozierok. All Rights Reserved.
Not responsible for any loss resulting from the use of this site.