- Welcome to lesson 19,
Deep Dive Quiz.
19 was all about, given the scenario,
implement and maintain identity and access management.
Now in lesson 19 one,
we talked about identity and access management.
In 19 two,
we looked at federated identity or portable identity,
including SAML and OAuth.
In 19 three, we looked at authentication,
various factors and, ways to implement authentication.
In 19 four, we dove right into biometrics.
In 19 five, we looked at access control and authentication.
And lastly, in 19 six,
we really talked about the all important concept
of privilege access management.
So now we're gonna do 10 questions together.
Are you ready for this quiz?
Make sure that you have a pen or pencil
and a piece of paper.
Put me on pause, absolutely as often as necessary,
so that you can be answering these questions.
So let's get started.
Our first question is to match the following
access control concepts and descriptions.
I'm gonna bring this up
so you can see it a little bit better.
So on the left hand side, we have rights, need to know,
dual control and separation of duties.
On the right hand side,
we have a demonstrated reason for requiring access,
entitlements granted to users,
requiring more than one subject to complete a specific task,
or breaking a task into separate processes
so that they're assigned to different subjects.
See if we can see that.
I dunno if there's a little bit more.
There we go.
Assigned to different subjects.
So why don't we start right up here on the right hand side.
Demonstrated reason for requiring access.
So, put me on pause if you want to
before I start giving you answers.
All right, demonstrated reason for requiring access.
That is gonna be,
our need to know.
Back up at the top,
entitlements granted to users.
Those are things like change system time,
or create a user, or install software.
That's gonna be our rights.
All right, requiring more than one subject
to complete a specific task,
or, breaking a task into separate processes
that are assigned to different subjects.
And we've got dual control,
and separation of duties.
What do you wanna choose?
Well, requiring more than one subject
to complete a specific task.
I'm going with dual control.
And breaking a task into separate processes
assigned to different subjects,
I'm gonna go with separation of duties.
So rights, entitlements granted to our users,
need to know, demonstrated reason for requiring access,
dual control, requiring more than one subject
to complete a specific task,
And separation of duties, breaking a task into
separate processes that are assigned to different subjects.
Do you agree?
Let's check it out.
And we are correct.
Okay, let's move on.
Sue Smith is an excellent long-term
management level employee who has held numerous positions
in the company.
Based on this information alone,
what concern might an auditor have?
Authorization creep, privileged management,
need to know or unauthorized access?
So they're a long-term management level employee.
It doesn't look like they're in IT
they're a management level employee,
and they've had numerous positions in the company.
Right, so over time, they've changed their positions a lot.
Based on just that piece of information,
what concern might an auditor have?
Authorization creep, privileged management,
need to know, or unauthorized access?
What are you gonna choose?
Well, there is no indication, right,
that, she has standing privilege, right?
There's nothing that says she's an IT administrator
or she's a custodian.
Need to know, doesn't really,
isn't really relevant here.
There's no suggestion that she's done anything wrong,
that there's any unauthorized access.
But because she's been here for a long time,
and she's had numerous positions,
absolutely as an auditor,
I would be concerned with authorization creep.
As she's moved from one position to another,
I wanna make sure that as
she's given new rights and permissions,
that her old rights and permissions have been recovered.
Do you agree?
All right, let's check.
And that is correct.
Question three.
On an annual basis, management is asked to validate
that user rights and permission assignments are correct.
This process is known as,
access attestation, accreditation,
role management, or change management?
So annually, in this case,
we're asking management to say,
yep those user rights and permissions
assignments are correct.
We're probably saying, are they also
in the right groups, or in the right roles?
Access attestation, accreditation,
role management, or change management?
What's the term we're gonna use?
Well, I like, access attestation.
Do you agree?
Let's try it.
And that's correct.
All right, this one is matching the access control terms
with their descriptions.
We have standing privilege, just-in-time PAM,
or privilege access management,
least privilege and zero standing privilege.
So, four terms that deal with privilege.
Standing privilege, j i t, just-in-time,
privilege access management
least privilege, and zero standing privilege.
On the right hand side, we have persistent privilege access,
a methodology to grant real-time privilege access,
the requirement to re-authenticate whenever
privilege is invoked,
and minimal rights and permissions.
These are all really important concepts.
Definitely put me on pause for a moment and match these up.
I wanna make sure you get these all right.
Well, standing privilege, right there,
it's persistent privilege access.
It's having privilege, all the time.
The next one,
our methodology to grant real-time privilege access,
well, those match right there too.
Right, that's our just in time privilege access management.
Now we have least privilege and zero standing privilege.
Either the requirement to re-authenticate whenever
privilege is invoked,
or minimal rights and permissions.
Well least privilege, right,
is our principle that we are going to assign
minimal rights and permissions.
And zero standing privilege,
you know what that is,
that's our requirement to re-authenticate
whenever privilege is invoked, right?
With zero standing,
we're saying you always have to be re-authenticating,
or re-validated over and over again, right?
There is no inherent trust
in a zero trust or zero standing trust environment.
You agree?
Let's check it out.
And that is correct.
All right, this one is gonna be a hotspot.
We're gonna have to choose a point on the image.
Which metric represents the high point of user frustration?
So we've got a couple of different sections here.
We've got our crossover error rate,
that's the red dot with the yellow circle.
The upper right hand side, we have the false reject rate,
or F R R, which are type one errors.
And down below, we have the fault accept rate,
the F R R, the type two errors.
So which one of these
represents the high point of user frustration?
The C E R, the F R R, or the F A R?
Go ahead and think about that for a moment.
Well, I'm gonna point to,
see if I can get it so it's not on there,
so you can see it.
The false reject rate,
or F R R type one error.
In a false reject rate,
that's when we have tuned our system
for a high sensitivity,
there's a chance of a legitimate user would not
be allowed to be authenticated.
Because maybe there's just something
a little bit different in their finger,
in their eye, however we're
biometrically authenticating them.
They've got a cold,
so their voice sounds a little bit different.
And so, the system is so sensitive,
that we're going to reject legitimate users.
And that is a source of user frustration.
So I'm gonna go with false reject rate type one errors.
Did you agree?
All right.
And that is correct.
In an ABAC model,
which of these attributes are avail, validated?
And you can choose all that apply.
Object, rules, subject, environmental conditions.
So we talked about ABAC, right?
Attribute based access control.
We said lots of different attributes are evaluated.
So I want you to choose all that apply.
You can put me on pause while you think about it.
Well, in an ABAC model,
the attributes of the object are evaluated,
the attributes of the subject are evaluated,
rules are evaluated, and operational
or environmental conditions are also evaluated.
So all of them.
Do you agree?
Let's check.
And that is correct.
Okay, in this access control model,
access is based on the relationship
between the subject's clearance and their need to know,
and the objects classification level.
Is the DAC, MAC, ABAC or RBAC?
DAC, discretionary access control,
and MAC, mandatory access control,
ABAC, attribute based access control,
and RBAC, role-based access control.
So that in this model, the access is based
on the relationship between the subject clearance
and their need to know,
and the objects classification.
What are you gonna choose?
Well, I'm gonna choose MAC,
mandatory access control,
because that's the model that's based
on the subject clearance,
Remember, clearance is a level of trust,
plus need to know, a demonstrated reason
for acquiring access and the objects classification level.
So, if I have a clearance of top secret,
I should be able to get to top secret information,
but I can't get to everything.
I also have to have a
demonstrated need to know.
What are the others?
In DAC, discretionary access control,
that's when the owner of the the data,
or the system, says who has access.
ABAC, that's attribute based access control.
And there we're looking at the subject
and the object and we're looking at rules
and operational or environmental conditions.
And RBAC, role-based,
that's where we're going to put our users into roles,
and then we will assign the access to the roles.
So I'm gonna go with MAC, do you agree?
Let's check.
And that is correct.
All right, I want you to click on the name
of the FIM technology that is depicted here.
We have a resource owner,
we have a requesting client application,
and, we have a resource or authorization server.
Is this SAML, OAuth two o,
Kerberos, or OpenID?
So, we have a picture here,
and we need to choose,
is this SAML, OAuth two o,
Kerberos, or OpenID?
Now first of all, it's a FIM technology,
so should be able to eliminate one right away,
like Kerberos,
which is not a FIM technology.
So I'm giving you part of that answer.
So now look at this, and say, we've got the resource owner,
the requesting client application,
and the resource, and also a resource authorization server
application programming interface.
This was the example I gave you about playing poker.
What is it?
I'm gonna choose,
OAuth two O, do you agree?
All right, let's check it out.
And that is correct.
All right, which of the following is an example
of multilayer authentication?
Multi layer,
that's the key word here.
Okay, you really wanna make sure
that you're reading your questions for comprehension.
If you read this quickly, you might say
which is a following example of, of multifactor?
'Cause that's what you were expecting, right?
This is an example of multilayer.
A geolocation and a pin,
a password and a finger scan,
smart card and voice recognition,
or cognitive and out of wallet questions.
An example of multi-layer authentication.
Okay, put me on pause as you read through those.
I wanna know which one's the example of multi-layer?
Remember that multi-layer is when I have,
multiple layers of the same factor.
So, let's go through these.
Geolocation and pin,
well, that would be somewhere I am
or location and something I know.
So, that's two different factors.
Password in a finger scan,
that's something I know and something I am, or biometric.
That's two different factors.
A smart card and voice recognition,
that's something I have and something I am, or biometric.
So that's two different factors.
So, the first three, geolocation and pin,
password and finger scan,
and smart card and voice recognition
are all two different factors.
Those are all two factors authentication.
The cognitive and out of wallet questions,
those are both the same factor.
They're both something I would know the answer to.
So that's gonna be my choice.
You agree?
I hope so.
Let's try it,
and it's right.
All right, let's do our last question.
Which statement is not true about identity proofing?
And again, I really want you to look for those key words.
In this case, not true, right,
just means which one is false.
Identity proofing is only required for federated identity,
identity proofing is a component
of fraud and identity prevention,
identity proofing involves confirming the authenticity
and accuracy of personal information,
and identity proofing may be a compliance requirement.
Now, three of those are true statements,
and one's a fault statement.
Put me on pause if you want
while you read through those again.
Well, I'm gonna start at the bottom.
Identity proofing may be a compliance requirement.
Definitely true.
identity proofing involves confirming the authenticity
and accuracy of personal information.
Absolutely.
Identity proofing is a component
of fraud and identity theft prevention.
Definitely.
So, so far we've got three true statements.
So what do we know about this one?
Identity proofing is only required for federated identity.
That is false.
Because of the word only.
Now, identity proofing may be required
for your federated identity, but it says it's only required
for federated identities, and that's not true.
We'll use identity proofing whenever we have to,
be able to, prove our an identity to be genuine.
So identity proofing.
I'm gonna choose that one and let's submit it.
And that is correct.
Awesome, 10 questions, you did great.
Congratulations.
Up next, we're gonna go into lesson 20
and explain the importance of
automation and orchestration to secure operations.
I'll see you there.