nerdexam
GIAC

GSEC · Question #328

Which of the following consists of the security identifier number (SID) of your user account, the SID of all of your groups and a list of all your user rights?

The correct answer is C. Security Access Token (SAT}. A Windows Access Token contains the user's SID, all group SIDs, and assigned privileges, and is created at logon to govern every access control decision for that session.

Access Control and Password Management

Question

Which of the following consists of the security identifier number (SID) of your user account, the SID of all of your groups and a list of all your user rights?

Options

  • ADiscretionary Access Control List (DACL)
  • BAccess Control Entry (ACE)
  • CSecurity Access Token (SAT}
  • DSystem Access Control List (SACL)

How the community answered

(66 responses)
  • A
    3% (2)
  • B
    8% (5)
  • C
    79% (52)
  • D
    11% (7)

Why each option

A Windows Access Token contains the user's SID, all group SIDs, and assigned privileges, and is created at logon to govern every access control decision for that session.

ADiscretionary Access Control List (DACL)

A DACL is attached to a securable object and contains ACEs specifying which users or groups are allowed or denied access to that object - it does not hold the authenticated user's own SID or privilege list.

BAccess Control Entry (ACE)

An ACE is a single entry within an access control list that grants or denies specific permissions to one principal for one object, not a structure that aggregates a user's full identity and rights.

CSecurity Access Token (SAT}Correct

When a user logs on, Windows creates an Access Token (also called a Security Access Token) that includes the user's SID, the SIDs of all groups the user belongs to, and the full list of privileges and user rights assigned to that account. The OS attaches this token to every process the user launches, and the Security Reference Monitor checks it against object DACLs to make authorization decisions.

DSystem Access Control List (SACL)

A SACL is also attached to a securable object and defines auditing rules specifying which access attempts generate security log events - it does not contain user SIDs or privilege assignments.

Concept tested: Windows Access Token structure and contents

Source: https://learn.microsoft.com/en-us/windows/win32/secauthz/access-tokens

Topics

#Security Access Token#SID#Windows security#access control

Community Discussion

No community discussion yet for this question.

Full GSEC Practice