foreign [Music]
good evening everyone and welcome I'm Dr Mann we
are going to be reviewing some Security Plus exam questions
tonight's topic is authentication controls Parts one and two let's get started with AAA
what does AAA refer to when concerning enforcing security policies take a
moment look over the answers and let's see what you're thinking
I think this one's fairly easy
you can put your responses in the chat
okay we've got responses coming in
okay so let's see what people are thinking
okay looks like we have a lot of votes exclusively folks for B Authentication authorization and
accounting and this is the correct answer the answers that would be hopefully eliminated fairly
quickly would be C and D access authentication and accounting access is definitely not part of AAA
and then amelioration that one doesn't fit either and that leaves questions answers
that leaves responses a and B so my question to you is why is a not the correct answer
the first pay in the acronym stands for authentication and not accounting
okay I mean and that's straight up knowledge yes um what else can you think of order matters
okay so that came in the chat order matters and it does this is backwards
right first you have to be authenticated than authorization says what you can do and
then accounting comes after the fact okay all right very good let's go to the next question
okay back in our back which comparison between attribute based access control or ABAC ABAC and
role-based access control or our back is a true statement take a moment look over the responses
Okay so we've got some responses coming in the chat let's see what people are thinking
okay A and C and A okay and I'm not sure and that's okay
okay so the correct answer here is C Choice C attributes based access control is the most
fine-grained type of Access Control where role based is not as precise and you may recall that um
role base of course allows access to resources and privileges um however a role is like a
container object and um the object has predefined privileges in the system so a user going into that
role also receives those privileges or Access Control permissions now a b a c configuration
covers more broad access controls and that's just not true that is just not the definition
um uh attributes-based Access Control assigns attributes or properties to users and resources
and then uses those attributes so for example you could configure a rule that specifies if the user
has a department attribute of say accounting and the city attribute of Boston then then perhaps
they can access a file okay this differs from role-based or even group based in the sense that
role-based and group based only check whether the user is in a role or a group so that's a
much wider thing than attributes based which is more fine-grained type of control okay all right
um role-based and attribute based are the same level of access but they just look
at two different parts and that's not true so again correct answer here is C attribute
based is the most fine-grained type of Access Control whereas role-based is not as precise
okay let's move on to the next question
account policy settings while attempting to log into your account a message pops
up telling you that your password is about to expire and you need to create a new one soon
after clicking the prompt to change your current password you attempt to enter a password you
have previously used before which user password setting would be the reason that another message
pops up saying that the password you entered does not meet the password policy requirements
okay take a look at the responses
and put your responses in your chat
okay we have several responses coming into chat
and their votes or Choice C password history and this is correct maximum password age
policy determines the period of time and days that a password can be used before the system
requires the user to change it account lockout not the correct answer nor is password complexity
okay those are kind of obvious very good and let's go on to the next question
okay authentication title when a user is logging onto a service via their desktop computer they
have the options to choose between being sent to push notification or getting a phone call after
entering their username and password what type of authentication is being used okay
Okay so we've got some responses coming in the chat
let's see what's on your mind okay so a b okay B but not sure okay all right so a p k i is public
key infrastructure which is a system for creating storing and distribution of digital certificates
um that really does not apply here
and that leaves us with out-of-band authentication digital signature and Mac and seems the rest of
the responses were for being and that is correct B is the correct choice okay so
when you put in your password your username and your password you are on a system
but when you get a push notification or even a phone call we call that out of band authentication
because it is going to another device that is not in the data path so to speak of the same system
that you entered your username and password on okay so we call it out of band Authentication
um this description does not align with the response digital signature nor does it align with
the response mandatory Access Control so again the correct answer out of band Authentication
okay
okay next question
conditional access
which of the following is the best example of conditional Access Control
take a moment and review the responses and then put your response in the chat
Okay so we've got some responses coming in
let's see what you're thinking
okay you have a choice for d a vote for D and several votes that could be
answer B okay a user is given access to a certain level of sensitive files based on the
project they have been assigned to and this is in fact an example of conditional access
take a look at the first response a government employee is only allowed to access information
that their security clearance allows them to access what is that an example of
role-based access say again please on role base access role-based yes okay um
could be but the wider access
in the resources for this exam and notably I believe the book that you're going to be getting
the um they make a point of stating that Mac involves employees gaining access to
resources based on their clearance level and the data classification of the resource and
they have to match up so the response a would be more correctly described as Mac
um what about seed an individual who created
a document gives access to their friend for peer review
what does that sound like
okay
temporary access okay
in terms of the main types of controls what do you think it would be
direct access control okay so it is discretionary accessible discretionary yes absolutely and this
is the definition um because the access is determined by the owner of the resource and it
says an individual who created a document that's the owner okay and the owner of the resource can
decide who gets access and who does not get access and then of course what kind of access they get
all right and then take a look at the last response a subject's account approval
is evaluated based on your current operating system
what do you think there
okay so these examples and associated with Access Control can be a little tricky
um so this sounds very much um again like mandatory Access Control
um and in this type of environment a Mac and environment okay so access to
research resource objects is controlled by the settings defined by say a system administrator
and so that would mean that access to Resource objects controlled by the operating system is
going to be based on what the sysadmin has already configured in the system
okay
let's go ahead on to the next question
describing MFA when signing into an account you are told to enter a pin and the last four digits
of your Social Security number to be authenticated does this describe multi-factor Authentication
okay
read over the responses and put your choice in the chat
okay we have a few responses let's wait a second and get a few more
okay all right let's see what you're thinking
okay so we have votes for d C
okay all right so the correct answer here is Choice d
does this describe MFA and the answer is no because it is not using a combination
of different authentication types okay the response a yes because it is requiring the
user to present at least two different credentials doesn't hold up okay that is an incorrect response
you enter a pin and the last four digits of your
Social Security number what are those both examples of
foreign
something you know that's correct and so that does not qualify as multi-factor
response B no because it is not requiring the user to present more than two different credentials
two different credentials is fine as long as the types are different and can be more
um response C yes because it is adding a layer of protection to the authentication no
incorrect answer okay very good let's move on to the next question
directory service which of the following describes a directory service
take a moment read the responses carefully and then put your choice in the chat
okay wow great we've got a lot of responses okay
and the majority are for Choice d
a network service that stores all user account information on a centralized database and
that is the correct choice take a look at response a a technology service that allows
a user to authenticate once then passes over to multiple other services what is that describing
okay single layer Authentication
single sign-on SSO right okay um response B A protocol that can be implemented
as special types of oauth flows with precisely defined token Fields anybody know what that is
okay so what's being described there is open ID connect let's take a look
at the chain no clue okay all right yeah so open ID connect and that is the definition
okay and response C a data format service based on XML that is used to exchange user
information between a client and a service and this is simply an XML web service
okay so again the correct answer D Choice D and network service that stores all user account
information on a centralized database very good all right let's move on to the next question
document workflow
you are helping Implement a document workflow system
and need each document to be legally traceable to its creator using your corporate pki system
which of the following solutions would best provide this form of
non-repudiation at the file level okay take a moment put your choices in the chat
okay got some choices in there all right and it looks like most are poor
in fact all of them are for response B document digital signatures this is the correct response
document encryption does not provide non-repudiation
okay s mime encryption secure multi-purpose internet mail extensions okay so this is a
widely accepted and used protocol for sending it digitally signed and encrypted messages
so not really involved with non-repudiation at the bile level
and then the last Choice document hashing is incorrect as well okay why would that be
what is the hash used for
okay so if we do some type of hashing what we're really trying to do is let's check the
chat we've got some responses in would just be able to tell if the document has changed
exactly does not prove who it belongs to correct so what we're doing is trying to ensure that the
original data has been preserved okay all right that's very good everybody is doing very well
hey let's go on to the next question Dynamic code
after entering your username and password in the login screen for your cloud account
you click submit and then a special code that changes every minute is created for
you to authenticate yourself what security measure is deploying this Dynamic code
okay so we have several responses in the chat
and they are
okay a couple for a three for B so the correct answer here is Choice feed and that is a
time-based one-time password code generated by an authentication system this is the correct response
in the First Response TGT this involves Kerberos authentication and we're talking about ticket
granting tickets so that's user authentication token issued by the key distribution center
that is used to request access tokens from the ticket granting service
for specific resources or systems joined to The Domain
and then response C short message service I think we all know what that is yeah why is that wrong
I'm sure you send and receive these things all the time it's not it's not a text message yeah exactly
so SMS involves settings text messages so no and certificate or authority certificate Authority
a CA is used or responsible for creation and management of digital certificates in public
key infrastructure so the best answer the one that is correct here is time-based one-time password
okay all right let's go on to the next
okay geotagging which of the following is the best example of geotagging
take a moment look at the responses you put your choice in the chat
like this we have some responses coming in we'll
wait just a few seconds let's see if we can get some more responses
okay so we have some responses in the chat
and it looks like they are for Choice a Choice a a user takes a photo that gets
GPS coordinates embedded into it this is the correct answer
if we look at response B someone can locate a person's location in real time by tracking
the coordinates of their mobile device so what does that describe what do we call that
I don't see any responses um that describes geolocation
Choice C a device that can report its location very accurately while Outdoors what is that
what does that describe
okay everybody some responses yeah GPS that's correct global positioning system
and in the last response a storefront can send push notifications when you are driving past it
what do we call that what is that an example of
a response in the chat NFC definitely involves NFC or can involve NFC yes
and RFID yeah
and so it's one of those Geo names
anybody want to take a guess
Okay so Choice D is referring to geofencing and it's a location-based service and as you've
mentioned yes it can use GPS Wi-Fi cellular RFID to create a boundary around a real geographic area
and then when somebody enters or exits this boundary okay it can trigger an
event such as a push notification okay let's go to the next question
ivp what does an identity provider do in a better rated Network
okay take a look at the responses put your choice in the chat
okay we have several responses
and it looks like they're all for Choice C
stores identity information about all the objects in a particular Network
including users groups servers client computers and printers hmm
so Choice C is actually referring to a directory service it's all inclusive
so we're going to obviously eliminate Choice C that leaves a b and d let's try this again
and we have a few responses in the chat
okay let's see what you're thinking hey and one vote for deed so the correct answer here is a
an identity provider holds user account information and performs Authentication
Choice B stores metadata data about when files were created accessed and modified
okay so this is response B stores metadata about when files were created accessed and modified
and metadata is created when you basically create documents or files the information is included now
there are tools that you can use to access and edit metadata such as metadata plus plus or e x
i f tool okay finally response d securely holds the key used to encrypt network drive contents
this is describing data encryption key encrypted hard drives utilize
two encrypted keys on the device to control the Locking and unlocking of data on a drive
these encryption keys are the data encryption key and the authentication key
the data encryption key is the key used to encrypt all of the data on the drive all right
let's go on to the next question
Microsoft active directory domain services
use the blank Authentication Protocol
so this is going to be a straight up knowledge based question what do you think
you have responses coming in
and looks like everybody is choosing D Kerberos and that is correct
response a security assertion markup language XML standard to Designed
or designed to allow systems to exchange authentication and authorization information
radius remote authentication dial-in user service networking protocol that provides centralized
authentication authorization and accounting for what we call AAA management for users who connect
and use a network service and 802.1 X this is response C common Authentication Protocol that
controls who gains access to a wired or wireless network by requiring the client to authenticate
against a central authentication database okay okay all right doing good next question
a multi-factor Authentication which of the following terms most closely relates
to multi-factor Authentication okay take a moment and let's see what you're thinking
okay we have several responses in the chat
yeah it looks like everybody's chosen response a token key and that is the correct response
SSO single sign-on that is not what we're talking about Pap what is pap
is it password Authentication Protocol yes it is and what's the problem with pep
it's not necessarily multi-factor and when we use password Authentication Protocol the big
problem is that information is sent in plain text so kind of really cool okay and response
D HSM is also incorrect HSM is a Hardware security module okay so that's not correct
what is the difference between HSM and TPM
okay so what is a TPM
okay we have a response
trusted platform module okay great so TPMS are typically chips included in the laptop
and they can you know work to provide full disk encryption
um a Hardware security module is either removable or an external device
that can generate store and manage RSA Keys okay so I guess the noteworthy difference between the
two is that again hsms are removable or external and TPMS aren't embedded into the device okay
I don't know let's go on to the next question
on premises to Cloud companies are starting to shift from using on-premises authorization
solutions to public cloud provider authorization Services Solutions
how might the change in processes be depicted take a moment and carefully read through these choices
and then put your choice in the chat
okay so two for D1 for C and the correct Choice here is d
many organizations originally used lightweight directory access protocol Technologies
but are now using some type of federation technology and that is the correct response
so on-premises authorization refers to a system where authentication and authorization services
are hosted locally within the organization's infrastructure cloud-based authorization
services are delivered from the cloud and do not require as many resources as an
on-premises multi-factor authentication surface okay all right so response a
not correct response B administration of accounts and devices change from being decentralized to
centralized not the best answer businesses start using bold disk encryption with cloud-based
virtual machines instead of on-premises virtual machines again not the best answer