Identification, Authentication, and Authorization ECSS Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the primary purpose of an Access Control List (ACL) in network security?

   • ATo define which users or systems are allowed or denied access to specific resources
   • BTo monitor and log all user activities on a network
   • CTo authenticate users by verifying their passwords
   • DTo encrypt data transmitted between two systems
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A growing company wants to centralize the management of user accounts, passwords, and access rights across its on-premises applications and cloud services. The security team also wants to enforce MFA for all administrative accounts and enable SSO for end users. Which framework should the company adopt to achieve these goals?

   • AA security information and event management (SIEM) system
   • BA standalone password manager
   • CIdentity and Access Management (IAM)
   • DA network access control (NAC) system
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A defense contractor requires employees to authenticate using a smart card that contains a digital certificate. To access a classified system, the employee inserts the smart card into a reader and enters a PIN. Which authentication mechanism is being used?

   • ATwo-factor authentication using a possession factor (smart card) and a knowledge factor (PIN)
   • BPassword-based authentication using the PIN only
   • CSingle-factor authentication using only the smart card
   • DBiometric authentication using the smart card's certificate
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A software development company has a shared code repository. The security team needs to implement an authorization model where the repository owner can grant read or write access to individual developers, but the owner cannot change the security classification of the repository, which is set by the system. Which authorization model should be used?

   • ARole-Based Access Control (RBAC)
   • BA hybrid model combining DAC for user permissions and MAC for system-level classification
   • CPure Mandatory Access Control (MAC)
   • DPure Discretionary Access Control (DAC)
   Reveal Solution Discussion Select an answer first
6. 30application · easy

   A company wants to implement a passwordless authentication method for its employees. The security team is evaluating options that rely on a physical device the user carries. Which authentication mechanism best fits this requirement?

   • AA security question
   • BA smart card
   • CA fingerprint scanner
   • DA password
   Reveal Solution Discussion Select an answer first