Authentication factors, access control models, and identity federation concepts tested on the CISSP exam.
35 cards · basic cards · AI-written, checked twice. Edit anything.
- Name the five authentication factors recognized in IAM
- Something you know, something you have, something you are, somewhere you are, something you do
- In authentication, what does 'something you know' refer to?
- Information only the user should possess, such as passwords or PINs
- In authentication, 'something you have' is...
- A physical object the user possesses, such as a smart card, token, or mobile device
- In authentication, 'something you are' refers to...
- Biometric characteristics unique to an individual, such as fingerprints, iris, or facial features
- In authentication, 'somewhere you are' refers to...
- Geographic location or network location that serves as an authentication factor
- In authentication, 'something you do' is...
- Behavioral biometrics such as typing pattern, gait, or signature dynamics
- What is multi-factor authentication (MFA)?
- Authentication using two or more distinct factors from different categories
- How does two-factor authentication (2FA) differ from multi-factor authentication (MFA)?
- 2FA uses exactly two factors; MFA uses two or more factors from different categories
- What is Single Sign-On (SSO)?
- A mechanism allowing a user to authenticate once and access multiple systems or applications without re-authenticating
- What is Mandatory Access Control (MAC)?
- Access control model where the operating system enforces access policies based on security labels and classifications assigned to users and resources
- What is Discretionary Access Control (DAC)?
- Access control model where resource owners determine and grant access permissions to other users
- What is Role-Based Access Control (RBAC)?
- Access control model where access permissions are granted based on a user's assigned role or job function
- What is Attribute-Based Access Control (ABAC)?
- Access control model using attributes of users, resources, environments, and actions to make access decisions
- What is the Bell-LaPadula model used for?
- A formal security model that enforces confidentiality through read down and write up rules to prevent unauthorized information disclosure
- What is the Biba model designed to protect?
- Data integrity by enforcing read up and write down rules to prevent unauthorized modification