One of the components in AAA is authorization. After a user is authenticated
through AAA, authorization services determine which resources the user can access and which
operations the user is allowed to perform.
2. What is the biggest issue with local implementation of AAA?
A. Local implementation does not scale well.
B. Local implementation supports only TACACS+ servers.
C. Local implementation cannot provide secure authentication.
D. Local implementation supports only RADIUS servers.
One of the purposes of AAA is to provide secure authentication to network
devices. Local implementation does not use RADIUS or TACACS+ servers. It relies on a local
database to authenticate all users. This can be a problem in a network that has many devices with
hundreds of users or more.
3. A company is experiencing overwhelming visits to a main web server. The IT department is
developing a plan to add a couple more web servers for load balancing and redundancy. Which
requirement of information security is addressed by implementing the plan?
Availability ensures that network services are accessible and performing well
under all conditions. By load balancing the traffic destined to the main web servers, in times of a
huge volume of visits the systems will be well managed and serviced.
4. What is an example of privilege escalation attack?
A. A threat actor sends an email to an IT manager to request the root access.
B. A DDoS attack is launched against a government server and causes the server to crash.
C. A threat actor performs an access attack and gains the administrator password.
D. A port scanning attack finds that the FTP service is running on a server that allows anonymous access.
With the privilege escalation exploit, vulnerabilities in servers or access control
systems are exploited to grant an unauthorized user, or software process, higher levels of
privilege than either should have. After the higher privilege is granted, the threat actor can access
sensitive information or take control of a system.
5. What is the principle of least privilege access control model?
A. Users are granted the strictest access control possible to data.
B. Users are granted rights on an as-needed approach.
C. Users control access to data they own.
D. User access to data is based on object attributes.
Accounting records what users do and when they do it, including what is
accessed, the amount of time the resource is accessed, and any changes that were made.
Accounting keeps track of how network resources are used.
7. Which objective of secure communications is achieved by encrypting data?
Server-based AAA authentication uses an external TACACS or RADIUS
authentication server to maintain a username and password database. When a client establishes a
connection with an AAA enabled device, the device authenticates the client by querying the
11. What three items are components of the CIA triad? (Choose three.)
Access control models are used to define the access controls implemented to
protect corporate IT resources. The different types of access control models are as follows:
o Mandatory access control (MAC) – The strictest access control that is typically used in military or
mission critical applications.
o Discretionary access control (DAC) – Allows users to control access to their data as owners of that
data. Access control lists (ACLs) or other security measures may be used to specify who else may
have access to the information.
o Non-discretionary access control – Also known as role-based access control (RBAC). Allows
access based on the role and responsibilities of the individual within the organization.
o Attribute-based access control (ABAC) – Allows access based on the attributes of the resource to
be accessed, the user accessing the resource, and the environmental factors such as the time of day.