If you’re planning to take the Security+ exam, you should have a basic understanding of account management that includes the access control methods used to control what the user can do.
For example, can you answer this question?
Q. Members of a project team came in on the weekend to complete some work on a key project. However, they found that they were unable to access any of the project data. Which of the following choices is the MOST likely reason why they can’t access this data?
A. Discretionary access control
B. Time-of-day access control
C. Rule-based access control
D. Role-based access control
More, do you know why the correct answer is correct and the incorrect answers are incorrect? The answer and explanation is available at the end of this post.
Recovering Accounts
In some situations, administrators need to recover accounts. The two primary account recovery scenarios are:
- Enable a disabled account. Administrators can reset the user’s password and take control of the account. Similarly, they pass control of the account to someone else such as a supervisor or manager of an ex-employee. Administrators reset the user’s password, set it to expire on first use, and then give the password to the other person.
- Recover a deleted account. It is also possible to recover a deleted account. This is more complex than simply creating another account with the same name. Instead, administrators follow detailed procedures to recover the account.
The 601 Version of the Study Guide
The CompTIA Security+: Get Certified Get Ahead: SY0-601 Study GuideEach of the eleven chapters presents topics in an easy to understand manner and includes real-world examples of security principles in action.
You’ll understand the important and relevant security topics for the Security+ exam, without being overloaded with unnecessary details. Additionally, each chapter includes a comprehensive review section to help you focus on what’s important.
Over 300 realistic practice test questions with in-depth explanations will help you test your comprehension and readiness for the exam. The book includes:
- A 75 question pre-test
- A 75 question post-test
- Practice test questions at the end of every chapter.
Each practice test question includes a detailed explanation to help you understand the content and the reasoning behind the question. You’ll be ready to take and pass the exam the first time you take it.
If you plan to pursue any of the advanced security certifications, this guide will also help you lay a solid foundation of security knowledge. Learn this material, and you’ll be a step ahead for other exams. This SY0-601 study guide is for any IT or security professional interested in advancing in their field, and a must-read for anyone striving to master the basics of IT security.
Prohibiting Generic Accounts
Another element of an account management policy prohibits the use of generic accounts. In Microsoft operating systems and domains, this means that personnel should not use the Guest account. Instead, administrators ensure the Guest account remains disabled.
As a reminder, access control requires that the system identifies and authenticates each user before granting them access. Imagine that five people are using the Guest account. In this scenario, users are not identified. If one of the users deletes all the files shared by the five users, it’s not possible to determine who actually deleted the files even if the system included detailed logging. The log would indicate that the files were deleted by the Guest account, but the actual person who deleted them could have been any of the five users.
Restricting Access Based on Time-of-Day
Time-of-day restrictions specify when users can log on to a computer. If a user tries to log on to the network outside the restricted time, the system denies access to the user.
As an example, imagine a company operates between 8:00 a.m. and 5:00 p.m. on a daily basis. Managers decide they don’t want regular users logging on to the network except between 6:00 a.m. and 8:00 p.m., Monday through Friday. You could set time-of-day restrictions for user accounts, as shown in the following figure. If a user tries to log on outside the restricted time (such as during the weekend), the system prevents the user from logging on.
User account properties with time restrictions
If users are working overtime on a project, the system doesn’t log them off when the restricted time arrives. For example, if Maggie is working late on a Wednesday night, the system doesn’t log her off at 8:00 p.m. (assuming the time restrictions are set as shown in the figure). However, the system will prevent her from creating any new network connections.
Remember this
Time-of-day restrictions prevent users from logging on during restricted times. It also prevents logged-on users from accessing resources during certain times.
Q. Members of a project team came in on the weekend to complete some work on a key project. However, they found that they were unable to access any of the project data. Which of the following choices is the MOST likely reason why they can’t access this data?
A. Discretionary access control
B. Time-of-day access control
C. Rule-based access control
D. Role-based access control
Answer is B. A time-of-day access control restricts access based on the time of day. It is sometimes used to prevent employees from logging on or accessing resources after normal work hours and during weekends.
None of the other options restrict access-based dates or times.
You may also like to view the blog post about Disabling User Accounts.
