# Access Control Systems > Methods and principles of managing user access, authentication mechanisms, and authorization frameworks - **Canonical URL:** https://flashcards.world/flashcards/sets/781f402e-d8e0-4bda-a63e-096c3d2a8c86/ - **Markdown URL:** https://flashcards.world/flashcards/sets/781f402e-d8e0-4bda-a63e-096c3d2a8c86.md - **Level:** basic - **Languages:** en → en - **Total Cards:** 50 ## Flashcards (50 Cards) | # | Front (Term / Prompt) | Back (Definition / Answer) | Example | Multiple-Choice Options | | :--- | :--- | :--- | :--- | :--- | | 1 | What is a cloud access security broker (CASB)? | A CASB is a security policy enforcement point that sits between cloud service users and providers to enforce security policies. | | | | 2 | What is Mandatory Access Control (MAC)? | MAC enforces access policies determined by a central authority, restricting user access based on security levels. | | | | 3 | What is an access control matrix? | An access control matrix is a table that defines the permissions granted to various users for different resources. | | | | 4 | What is a security token's lifespan? | The lifespan of a security token refers to the duration for which it remains valid before it needs to be renewed or replaced. | | | | 5 | What is two-factor authentication (2FA)? | 2FA requires two forms of verification, typically something you know (password) and something you have (token). | | | | 6 | What is an access control system? | An access control system is a framework that manages who can access resources in a computing environment. | | | | 7 | What is a data loss prevention (DLP) solution? | DLP solutions monitor and protect sensitive data from unauthorized access, use, or transmission. | | | | 8 | What is the purpose of access control policies? | Access control policies define the rules and guidelines for granting or denying access to resources within an organization. | | | | 9 | What is a VPN and how does it relate to access control? | A VPN (Virtual Private Network) creates a secure connection over the internet, allowing remote users to access resources safely. | | | | 10 | What is a network access control (NAC)? | NAC is a security solution that enforces policies on devices attempting to access a network, ensuring compliance and security. | | | | 11 | What is a zero-trust security model? | A zero-trust security model assumes that threats could be internal or external, requiring strict verification for every access attempt. | | | | 12 | What is a security framework? | A security framework is a structured approach to managing security risks and ensuring compliance with regulations and standards. | | | | 13 | What is the purpose of logging and monitoring in access control? | Logging and monitoring track access attempts and activities to detect unauthorized access and ensure compliance. | | | | 14 | What is a security audit? | A security audit is an evaluation of an organization's security policies, procedures, and controls to ensure compliance and effectiveness. | | | | 15 | What is the role of a security operations center (SOC)? | A SOC monitors and analyzes an organization's security posture on an ongoing basis, responding to security incidents. | | | | 16 | What is a session timeout? | A session timeout is a security feature that automatically logs a user out after a period of inactivity. | | | | 17 | What is a security policy? | A security policy is a formal document that outlines an organization's approach to managing security and access control. | | | | 18 | What is the difference between authentication and authorization? | Authentication verifies identity, while authorization determines what an authenticated user is allowed to do. | | | | 19 | What is a token-based authentication system? | Token-based authentication uses a token to verify a user's identity, often used in web applications for secure access. | | | | 20 | What is Role-Based Access Control (RBAC)? | RBAC assigns access rights based on user roles within an organization, simplifying management of permissions. | | | | 21 | What is a data breach notification requirement? | Data breach notification requirements mandate organizations to inform affected individuals and authorities about data breaches. | | | | 22 | What is the role of incident management in access control? | Incident management involves responding to and managing security incidents to minimize impact and restore normal operations. | | | | 23 | What is a digital certificate? | A digital certificate is an electronic document used to prove the ownership of a public key, facilitating secure communications. | | | | 24 | What is the role of a firewall in access control? | A firewall monitors and controls incoming and outgoing network traffic based on predetermined security rules. | | | | 25 | What is a risk management framework? | A risk management framework provides guidelines for identifying, assessing, and mitigating risks to an organization's assets. | | | | 26 | What is the role of encryption in access control? | Encryption protects data by converting it into a secure format that can only be read by authorized users. | | | | 27 | What is a security token service (STS)? | An STS is a service that issues security tokens for authentication and authorization in a federated identity system. | | | | 28 | What is a biometric authentication method? | Biometric authentication uses unique biological traits, such as fingerprints or facial recognition, to verify identity. | | | | 29 | What is Discretionary Access Control (DAC)? | DAC allows resource owners to determine who can access their resources, often using permissions. | | | | 30 | What is the importance of regular access reviews? | Regular access reviews ensure that user permissions are appropriate and help identify any unauthorized access. | | | | 31 | What is a security incident response plan? | A security incident response plan outlines procedures for detecting, responding to, and recovering from security incidents. | | | | 32 | What is authentication in access control? | Authentication is the process of verifying the identity of a user or system before granting access. | | | | 33 | What is single sign-on (SSO)? | SSO allows users to log in once and gain access to multiple applications without re-entering credentials. | | | | 34 | What is a user role in RBAC? | A user role in RBAC defines a set of permissions that can be assigned to users based on their job functions. | | | | 35 | What is a user provisioning process? | User provisioning is the process of creating, managing, and deleting user accounts and access rights within a system. | | | | 36 | What is the difference between physical and logical access control? | Physical access control restricts access to physical locations, while logical access control restricts access to digital resources. | | | | 37 | What is a risk assessment in access control? | A risk assessment identifies and evaluates potential risks to an organization's information and access control systems. | | | | 38 | What is the significance of data classification in access control? | Data classification helps determine the level of security required for different types of data, guiding access control measures. | | | | 39 | What is a privilege escalation attack? | A privilege escalation attack occurs when a user gains elevated access to resources that they are normally not allowed to access. | | | | 40 | What is the concept of 'separation of duties'? | Separation of duties is a security principle that ensures no single individual has control over all aspects of a transaction. | | | | 41 | What is the purpose of an identity management system? | An identity management system helps manage user identities and access rights across various systems and applications. | | | | 42 | What are common authentication methods? | Common methods include passwords, biometrics, smart cards, and two-factor authentication (2FA). | | | | 43 | What is a multi-factor authentication (MFA)? | MFA requires two or more verification factors to gain access, enhancing security beyond just a password. | | | | 44 | What are the main types of access control models? | The main types are Discretionary Access Control (DAC), Mandatory Access Control (MAC), and Role-Based Access Control (RBAC). | | | | 45 | What is the principle of least privilege? | The principle of least privilege states that users should have the minimum level of access necessary to perform their tasks. | | | | 46 | What is a security token? | A security token is a physical or digital object used to gain access to a system, often used in authentication. | | | | 47 | What is a security breach? | A security breach is an incident where unauthorized access to data, applications, or networks occurs. | | | | 48 | What is an access control list (ACL)? | An ACL is a list that specifies which users or groups have access to specific resources and what actions they can perform. | | | | 49 | What is a password policy? | A password policy outlines rules for creating and managing passwords to enhance security and reduce vulnerabilities. | | | | 50 | What is the role of user education in access control? | User education helps individuals understand security policies and practices, reducing the risk of security breaches. | | | --- Study this deck interactively with FSRS-6 spaced repetition, audio review, and multiple-choice mode at [Flashcards World](https://flashcards.world/flashcards/sets/781f402e-d8e0-4bda-a63e-096c3d2a8c86/).