foreign [Music]
the topic for this evening is part two of authentication
controls and let's start with the first question
password Authentication Protocol which of the following is true regarding happy
okay several responses in the chat
and they're all looks like it looks like they're all for response C it relies on
Plain text password exchange and yes as we discussed in the first part it absolutely does
um it was developed as a means of authenticating users over a Remote Link
hmm possibly but not the best answer it guards against replay attacks no and response
D it is an encrypted tunnel that passes a password from one port to another it is not
in fact it is very weak and because of its use of plain text okay let's go on to the next question
proposed method a lead developer and apple technology has proposed an authentication
mechanism to implement in their new smart watches instead of using a fingerprint scanner
the idea of this authentication mechanism is for the smart watch to recognize if the user
is allowed or not solely by their distinctive walking movements what type of authentication
method is this developer proposing okay we already have lots of responses here
and they are perceived and that's that is correct gate analysis
um somebody's gate refers to how they walk so that one was I think pretty easy um it is obviously not
involved with any kind of swiping patterns or RFID or Biometrics although gain analysis
your gate I suppose could be considered biometric but the best answer here is gait analysis okay
next question
security assertion markup language tokens possess what kind of data after being granted access
that's look at the responses and butcher choice in the chest
okay let's see what you're thinking
so we have a vote for c b and a kind of hitting all around it
so the correct Choice here is D responds to clean data security assertion markup language is an XML
standard designed to allow systems to exchange authentication and authorization information
this is often used with identity Federation and claims-based authentication so claim data is the
correct answer biometric data is incorrect pkc data this is response B public key cryptography
that's a cryptographic algorithm and crypto system component implemented
widely pkc facilitates confidentiality data Integrity authentication and non-repudiation
it's also a digital signature algorithm component and used to authenticate a private Key verifiable
by anyone with authorized public key access and of course we're talking about validating
messages between origin and sender okay plain text Data no we were talking about
security assertion markup language plain text is incorrect okay let's go on to the next question
SNMP version 3 hashing algorithm SNMP V3 authentication allows the
use of which hashing algorithm below your choices are md5 hashing is h a
options A and B being correct or d none of the options are correct
okay so we have some responses coming in
and let's see what you're thinking
today's favorite Choice a vote for d a vote for a a vote for C
and in fact the correct answer is Choice C options A and B are correct so md5
secure hash algorithm these are both used by SNMP version three um if you need greater security
than you can use data encryption standard okay so G is incorrect and either A or B
by themselves is incorrect options A and B all right let's move to the next question
okay which of the following is not true regarding SNMP version 3. take a moment look at the response
and make your choice
okay so we have a single response okay there's another one let's get a few more
okay let's see what everybody's thinking we have votes perceived Choice C and choice C
SNMP version 3 is a network traffic monitoring is the correct choice this is one of those not type
question which of the following is not true both A and B are true indeed okay so what is it about
Choice C that makes it the correct answer
Okay so simple Network management protocol is a protocol used in network monitoring
but this response says Network traffic monitor and that tends to lead more to
um land analyzers packet snippers okay so it's it's too specific and it's describing something
that is more Associated closely associated with packagemaking okay snmp3 is a network monitor
okay let's move to the next question
SSH passphrase once the sys admin configured the Linux file server to allow SSH key based
Authentication some users began complaining that their client machines are asking them
for a passphrase when logging in using key based Authentication what is most likely the problem
okay read the responses carefully and then make your choice in the chat
Okay so we've got some responses coming in
as you look at the responses think about one that you can fairly quickly eliminate
okay so there must be a lot of thinking going on out there
let's see what we have in the chat we have a vote for B
okay and not another you can eliminate deep okay one of the responses that sticks out is
is wrong in my mind is response C the SSH client used the wrong SSH client options
so if you're using the ssh- Keygen okay which is a command line utility
and you look at some of the parameters like Dash T their type of key to create
or Dash C to put a comment um really this is kind of a silly answer okay so an option
perhaps it misdews can lead to unexpected Behavior but typically
it's not going to be a reliable answer certainly not a good answer um
so the correct answer here is response a the SSH public slash private key pair was likely
generated using a passphrase by the client okay so if you do that you're going to get prompted if
you don't if you leave it blank then you're not going to get prom get prompted for a passphrase
okay um the SSH server's private key did not match the user's private key now someone said
um eliminate deep and that's also a good one to eliminate so I would say that's responses C and D
were the ones that could most easily be eliminated what's what's the what's wrong with response d
is a server going to contain the private key
can't mismatch so the user maintains their private key servers typically have the public key
okay this SSH server was likely configured by the sysadmin to require passphrases and no
okay all right so again public private key pair was likely generated using a passphrase
that's what we'll do it okay let's move on to the next question
SSH public and private keys your organization's network administrator
is configuring a Linux server's SSH Authentication to allow key based Authentication
this setup requires that the private key is blank and the public key is blank
okay what do you think you just kind of touched on this in the last question hey
so we have some responses coming in and
okay responses proceed mainly and one per game so the correct response is seen okay the private key
is kept with the user and the public key is on the next server okay and this makes sense and
this is how it works okay so private key kept with the user public user no private key check
with the Linux host public key Capital bonix house now and choice D kept with the Linux host
so correct answer is Choice C the private key is kept with the user the public key is on the server
see we have sent to image see okay right all right let's move to the next question
this one involves security policy a user logs into their account from their home computer in
California one hour later a login attempt is made from their personal laptop in Virginia
but it is denied an alert is sent to the system administrator and the account is disabled
what security policy is most likely being utilized in this situation okay
okay we have a couple of responses
again when you're looking at this try to think about which responses can be eliminated
or which don't make sense
it's always helpful when you can narrow down your choices
okay
so it looks like we're holding it two responses let's see where we are
both votes for deep impossible travel time policy is the correct answer
time of day policy restricts access to certain resources to the time of day okay now what's
obviously strange about this is that there's a three hour time difference between Virginia and
California so if one hour later a login attempt is made from Virginia right that doesn't make sense
firewall policy that is not really a reasonable option uh response
um location-based policy is a security policy that restricts access to certain
resources based on the location of the user and so as an example a company May restrict
access to files or applications based on the network location of a user okay
um the main benefit of setting up location-based policies is to avoid data leakage
once you have defined trusted Network locations no one can access resources from different say
Network location or device okay impossible travel time policy is the best and correct answer here
okay all right let's go on to the next
smart key and key bomb Okay so 50 chance here of getting this correct using a smart card
and key fob counts as multi-factor authentication is this a true statement or a fault statement
okay I'm going to wait till we get enough responses in the chat and
we've got a few okay all right let's see what everyone's thinking
okay so it looks like yeah everybody's thinking false okay yeah so this is false
um smart cards and key fobs well you tell me why is it false
something you have correct they are both something you have and that does not count
as multi-factor authentication so very good everyone okay let's go on to the next question
something you do all of the following is true regarding the authentication attribute
something you do except which of the following
okay so one of these responses
is not true regarding the authentication attributes something you do
a we've got responses coming in let's see what everyone's thinking
okay so c b and d
okay so is a user's typing speed and or a pattern of user inputs is that something you do
yes yes okay
this method is subject to higher error rates is that a true statement
I think so okay may ask why
why do you think that prayer I don't know I I'm thinking practically so if if typing
speed and pattern is like something you do that can change yes it can yeah because as humans we
you know that can change based on emotion based on physical based on so many different things so
yeah it can sure when you're in a hurry you know your typing speed may be faster if they're just
trying to get something done and get out of it so yes the point very much is that things can change
response C how one holds their smartphone I mean that that's almost silly because
there's so many different ways right okay yes human error Too Many Factors absolutely
so the best choice of all of these here is response d this factor is practical to use
as a primary way of authentication and it's not because something you do with the way we do things
is subject to change for many many different reasons so it's just not reliable okay very good
okay next question type of model the blank model is used to allocate labels to objects
and subjects for Access Control clearances okay take a look at these and let's see what you think
okay let's see what everyone's thinking indeed yep very good we touched on this in part one
um that this is more uh related to mandatory access control and again
um the text that she will be receiving makes a point of mentioning this
so not discretionary Access Control um discretionary Access Control
uses what you might call Access Control entities the other term you're going to hear is
um dacl discretionary Access Control list okay um and one of the more common examples of that is
um as a particular user and even on your own system you can right click on a resource on your
computer and bring up the properties dialog on a Windows system and then you can actually see you
know in the I believe it's the security tab who has access to one so system administrator your
user account which may be an administrator account as well and that's a common example
for discretionary access using an access control list okay we've talked about role-based um and
attribute based and neither of those is correct so mandatory access control is the correct response
okay and let's move to the next question
okay type of restriction what type of authentication restriction would
allow an employee to log into an internet facing employee web portal from the U.S but not cremation
which type of authentication restriction okay
yeah we got lots of responses on this one because
it's pretty obvious we're talking about geolocation restrictions okay all right
okay and the last question
type of security control a museum already has security guards and security cameras near their
exhibit and they just recently upgraded their security controls by installing light fixtures
that point to the exhibit and towards the crowd which type of security control is this
okay quite a few responses in the chat let's see what you're thinking
and we have votes for C looks like the majority proceed which is deterrent and this is the correct
choice for this question um detective controls are security measures implemented by an organization
to detect unauthorized activity um or some type of security incident in general and send alerts to
concerned individuals um would that also include like unauthorized access yes so for example
um I mean actually there are several examples so one of those could be the activation of say a door
along okay which is physical control right because if you don't have authorization to open the door
then right you don't have what it takes and we're going to hear an alarm um the implementation of
an intrusion detection system okay that one's kind of obvious and that's a technical control
um if you're doing an an audit um in internal audit and um you find that a user has
um excessive access rights for example so there's another type which is an administrative control
so those are detective controls compensating security controls um first of all very
widely and and they vary based upon um what a particular need is being met so you know based
on the organization's needs and in particular um and one of those uh could be um if you um
if there's an attack okay and let's say that you know data was destroyed okay so um using a good
back backup a good backup after an attack that deleted the data that would be an example of a
compensating control and then operational security controls are primary primarily
implemented and executed by people as opposed to systems okay um they're typically put in place
to improve the security of a particular system or group of systems and supplement the security
of an organization uh in a manner which in which both physical and Technical elements are utilized
um let's see so operational security controls include for example in overarching security policy
um uh certainly acceptable use policy or security awareness training policy and these
are examples of operational controls but in the question the correct answer is C deterrent okay
all right and that finishes up authentication controls topic area