360 Appendix ■ Answers
16. D. Need to know is applied when subjects like Alex have access to only the data they need
to accomplish their job. Separation of duties is used to limit fraud and abuse by having
multiple employees perform parts of a task. Constrained interfaces restrict what a user can
see or do and would be a reasonable answer if need to know did not describe his access
more completely in this scenario. Context-dependent control relies on the activity being
performed to apply controls, and this question does not specify a workflow or process.- D. The client in Kerberos logins uses AES to encrypt the username and password prior to
sending it to the KDC. - C. The KDC uses the user’s password to generate a hash and then uses that hash to
encrypt a symmetric key. It transmits both the encrypted symmetric key and an encrypted
time-stamped TGT to the client. - B. The client needs to install the TGT for use until it expires and must also decrypt the
symmetric key using a hash of the user’s password. - A. Retina scans can reveal additional information, including high blood pressure and
pregnancy, causing privacy concerns. Newer retina scans don’t require a puff of air, and
retina scanners are not the most expensive biometric factor. Their false positive rate can
typically be adjusted in software, allowing administrators to adjust their acceptance rate
as needed to balance usability and security. - C. Mandatory access control systems are based on a lattice-based model. Lattice-based
models use a matrix of classification labels to compartmentalize data. Discretionary access
models allow object owners to determine access to the objects they control, role-based
access controls are often group based, and rule-based access controls like firewall ACLs
apply rules to all subjects they apply to. - C. Dictionary, brute-force, and man-in-the-middle attacks are all types of attacks that are
frequently aimed at access controls. Teardrop attacks are a type of denial of service attack. - A. Logging systems can provide accountability for identity systems by tracking the
actions, changes, and other activities a user or account performs. - B. As an employee’s role changes, they often experience privilege creep, which is the
accumulation of old rights and roles. Account review is the process of reviewing accounts
and ensuring that their rights match their owners’ role and job requirements. Account
revocation removes accounts, while re-provisioning might occur if an employee was
terminated and returned or took a leave of absence and returned. - A. Biba uses a lattice to control access and is a form of the mandatory access control
(MAC) model. It does not use rules, roles, or attributes, nor does it allow user discretion.
Users can create content at their level or lower but cannot decide who gets access, levels
are not roles, and attributes are not used to make decisions on access control. - C. RADIUS is an AAA protocol used to provide authentication and authorization; it’s
often used for modems, wireless networks, and network devices. It uses network access
servers to send access requests to central RADIUS servers. Kerberos is a ticket-based
authentication protocol; OAuth is an open standard for authentication allowing the use
of credentials from one site on third-party sites; and EAP is the Extensible Authentication
Protocol, an authentication framework often used for wireless networks.