Chapter 2: Access Control

1. You are working on a presentation for upper management on how a new access control system will work. What three steps do you show are necessary for access to be granted to an access control object?

   1. Authentication, repudiation, and identification

   2. Authentication, identification, and authorization

   3. Identification, repudiation, and availability

   4. Identification, authorization, and assurance

   Answer B is correct. These are the three steps required in any access control system in order to grant access to objects.

   Answer A is incorrect because authentication, repudiation, and identification as repudiation refers to the ability to prove that a specific entity performed an action. This is not a step in obtaining access to objects. Answer C is incorrect because repudiation is not a step in obtaining access to objects and neither is availability, which refers to the ability to use the access control system itself. Answer D is incorrect because assurance is the part of access control that includes confidentiality, integrity, availability, and accountability. As such, assurance is not a specific step in gaining access to an object.

2. What advantage does a centralized access control methodology offer to security administrators?

   1. It provides a method to ensure that the authentication responsibility is broken up across multiple systems.

   2. It allows users to use a single ID and password to access all resources on the network.

   3. It provides a method to ensure that all authentication responsibility is...