Module 19: Access Control questions with 100% complete solutions

Module 19: Access Control questions with 100% complete solutionsAttribute-based access control (ABAC) - ANS This is an access control paradigm whereby access rights are granted to users with policies that combine attributes together. Rule Based Access Control (RBAC) - ANS An access control model that can dynamically assign roles to subjects based on a set of rules defined by a custodian. Time-based access control - ANS A user might be allowed to connect to the network only during specific times of day. AAA (authentication, authorization, and accounting) - ANS Authentication - Users and administrators must prove that they are who they say they are. Authentication can be established using username and password combinations, challenge and response questions, token cards, and other methods. AAA authentication provides a centralized way to control access to the network. Authorization - After the user is authenticated, authorization services determine which resources the user can access and which operations the user is allowed to perform. An example is "User 'student' can access host server XYZ using SSH only." Accounting - Accounting records what the user does, including what is accessed, the amount of time the resource is accessed, and any changes that were made. Accounting keeps track of how network resources are used. An example is "User 'student' accessed host server XYZ using SSH for 15 minutes." Terminal Access Controller Access-Control System Plus (TACACS+) - ANS It separates authentication, authorization, and accounting functions according to the AAA architecture. This allows modularity of the security server implementation. Mostly Cisco supported TCP port 49 Bidirectional challenge and response as used in Challenge Handshake Authentication Protocol (CHAP) Encrypts the entire body of the packet but leaves a standard TACACS+ header. Provides authorization of router commands on a per-user or per-group basis Limited Remote Authentication Dial-In User Service (RADIUS) - ANS It combines authentication and authorization but separates accounting, which allows less flexibility in implementation than TACACS+ Open/RFC standard UDP ports 1812 and 1813, or 1645 and 1646 Unidirectional challenge and response from the RADIUS security server to the RADIUS client Encrypts only the password in the access-request packet from the client to the server. The remainder of the packet is unencrypted, leaving the username, authorized services, and accounting unprotected. Has no option to authorize router commands on a per-user or per-group basis Extensive