IT Infrastructure Security Policies Review Questions with complete Solutions Rated A+
access controls - Answers security features that govern how users and processes communicate and
interact with systems and resources
three common attributes of access controls - Answers identification scheme
authentication method
authorization method
security posture - Answers it is the organization's approach to access control
two fundamentals security postures - Answers secure, which implements the "default deny" model
open, which implements the "default allow" model
default allow - Answers by default, out of the box, no security is deployed, everyone can do everything
(easier to deploy, no security)
default deny - Answers aka "deny all", access is unavailable by default until the appropriate control is
altered to allow access
principle of least privilege - Answers the least amount of permissions granted users that still allow them
to perform whatever business tasks they have been assigned, and no more
protects the data but also protects users, they can't be accused of having deleted a file to which they
can't gain access
authentication - Answers subject must supply verifiable credentials offered referred as factors
single-factor
multifactor
three categories of factors - Answers knowledge - something you know (PIN, password, etc.)
possession - something you have (OTP, smart cards, memory cards)
inherence - something you are (biometrics)
three primary authorization models - Answers object capability - used programatically and based on a
combination of a unforgettable reference and an operational message
access controls - Answers security features that govern how users and processes communicate and
interact with systems and resources
three common attributes of access controls - Answers identification scheme
authentication method
authorization method
security posture - Answers it is the organization's approach to access control
two fundamentals security postures - Answers secure, which implements the "default deny" model
open, which implements the "default allow" model
default allow - Answers by default, out of the box, no security is deployed, everyone can do everything
(easier to deploy, no security)
default deny - Answers aka "deny all", access is unavailable by default until the appropriate control is
altered to allow access
principle of least privilege - Answers the least amount of permissions granted users that still allow them
to perform whatever business tasks they have been assigned, and no more
protects the data but also protects users, they can't be accused of having deleted a file to which they
can't gain access
authentication - Answers subject must supply verifiable credentials offered referred as factors
single-factor
multifactor
three categories of factors - Answers knowledge - something you know (PIN, password, etc.)
possession - something you have (OTP, smart cards, memory cards)
inherence - something you are (biometrics)
three primary authorization models - Answers object capability - used programatically and based on a
combination of a unforgettable reference and an operational message
