GSEC Access Control and Password Management — 10 Questions

Question 1

An organization requires that users authenticate via a smart card and a PIN to access secure network resources. Which access control model is being enforced?

Accepted Answer

Multifactor Authentication. This scenario describes multifactor authentication, which is a core component of strong access control. By requiring both a physical possession factor (smart card) and a knowledge factor (PIN), the organization achieves higher assurance. Access control models rely on these mechanisms to verify identity before authorization decisions are made, ensuring that only authenticated users can interact with sensitive system assets and data, reducing the risk of unauthorized access through credential theft.

Answer

Role-Based Access Control

Answer

Discretionary Access Control

Answer

Mandatory Access Control

Question 2

Refer to the exhibit. An administrator applies this JSON policy to an S3 bucket. What is the intended effect of this access control policy?

Accepted Answer

It enforces encryption in transit for S3 objects. This policy enforces encryption in transit by explicitly denying any s3:GetObject request that is not sent over a secure, encrypted connection (HTTPS). By checking the aws:SecureTransport condition key, the policy ensures that unencrypted traffic is rejected regardless of any other permissions granted to the user. This is a critical security control for protecting sensitive data from interception while being transmitted across the network between the client and the cloud storage.

Answer

It restricts access to specific IP addresses

Answer

It grants public read access to the bucket

Answer

It prevents bucket deletion by unauthorized users

Question 3

Which TWO of the following are considered 'something you are' authentication factors?

Accepted Answer

Retina scan. Biometric factors rely on the physical or behavioral characteristics of an individual to verify identity. These factors are unique to the person and provide a high level of assurance. In access control, these are often used in conjunction with other factors to implement robust multifactor authentication, ensuring that the person requesting access is who they claim to be based on intrinsic biological features rather than items they possess or know.

Answer

Hardware token

Answer

Security question

Answer

Digital certificate

Question 4

A system administrator implements a policy where users can only access the server room during their scheduled shifts. Which type of access control is this?

Accepted Answer

Attribute-Based Access Control. This is an example of context-aware access control, specifically temporal or time-based access control. By restricting access based on the time of day, the organization limits the window of opportunity for an attacker or an insider to perform unauthorized activities. This adds a layer of defense-in-depth, ensuring that system resources are only accessed during authorized business hours, reducing the risk of malicious activity occurring when the building or office is empty.

Answer

Role-Based Access Control

Answer

Discretionary Access Control

Answer

Mandatory Access Control

Question 5

Refer to the exhibit. Based on the error log, why was the request denied?

Accepted Answer

The user lacks the required permission for the action. The error occurs because the user 'jdoe' belongs to a group with only 'Read Only' permissions, which does not include the 's3:PutObject' action required to upload or write a file. Access control systems follow the principle of least privilege, and since the user lacked the specific permission to modify the object, the request was rejected. This highlights the importance of correct group-to-permission mapping in managing enterprise access control policies effectively.

Answer

The user is not authenticated

Answer

The resource path is incorrect

Answer

The system is undergoing maintenance

Question 6

A security engineer is configuring a Linux server that hosts a shared financial application. The company's access control policy mandates that authentication and authorization decisions be made by a central server, and that users be granted access based on their role in the finance department. The engineer installs and configures the SSSD daemon to integrate with the corporate LDAP directory. Which access control model is being implemented?

Accepted Answer

Role-Based Access Control (RBAC). The central LDAP directory stores user attributes, including department or role, and SSSD enforces access based on those roles. This is the defining characteristic of Role-Based Access Control, where permissions are assigned to roles and users are assigned to roles. The other models do not rely on directory-based role assignments for centralized authorization.

Answer

Mandatory Access Control (MAC)

Answer

Rule-Based Access Control (RuBAC)

Answer

Discretionary Access Control (DAC)

Question 7

A security administrator is configuring a Linux server to enforce a password policy that locks an account for 30 minutes after five failed login attempts within a 10-minute window. The administrator wants to avoid locking out the root account to prevent accidental denial of service. Which file should be edited to apply these settings?

Accepted Answer

/etc/pam.d/system-auth or /etc/pam.d/common-auth, depending on distribution. The correct file is the PAM configuration file for authentication, typically /etc/pam.d/system-auth or /etc/pam.d/common-auth. These files define the authentication stack where modules like pam_faillock or pam_tally2 are invoked. By adding parameters such as deny=5 and unlock_time=1800, and using even_deny_root or excluding root, the administrator can enforce the lockout policy while protecting the root account. Other files control different aspects of password and login policy.

Answer

/etc/login.defs

Answer

/etc/securetty

Answer

/etc/security/pwquality.conf

Question 8

A user reports that they are unable to log into their workstation after returning from vacation. The help desk verifies that the user's account is not locked out and the password has not expired. Which of the following is the most likely cause?

Accepted Answer

The user's account has been disabled.. The help desk confirmed the account is not locked out and the password has not expired. The most likely remaining cause for a login failure is that the account has been disabled. Disabled accounts cannot log in regardless of correct credentials. Other options like wrong password, clock skew, or password expiration are either ruled out by the scenario or less likely given the specific user and verified conditions.

Answer

The user's password has expired.

Answer

The workstation's clock is out of sync.

Answer

The user is typing the wrong password.

Question 9

Which password management practice best minimizes the impact of a credential stuffing attack?

Accepted Answer

Enforcing unique passwords per service. Credential stuffing relies on users reusing the same passwords across multiple services. By enforcing unique, complex passwords for every single account, users ensure that a compromise at one service does not lead to a cascade of compromises elsewhere. This is the single most effective defense against automated attacks that attempt to use leaked database dumps to gain unauthorized access to other unrelated accounts held by the same user.

Answer

Mandating password changes every 30 days

Answer

Requiring a minimum password length of 8 characters

Answer

Disabling account lockout after failed attempts

Question 10

Which of the following describes the 'Principle of Least Privilege' in an access control context?

Accepted Answer

Providing users only the access required to complete their tasks. The Principle of Least Privilege (PoLP) mandates that users should only be granted the minimum level of access necessary to perform their job functions. This minimizes the attack surface; if a user account is compromised, the potential damage is restricted to the limited permissions assigned to that account. This is a fundamental security concept for preventing lateral movement and privilege escalation during an active incident or breach.

Answer

Granting all employees access to the root directory for troubleshooting

Answer

Using the same shared password for all administrative accounts

Answer

Ensuring all users have administrator rights for software updates