NCP-GENL: Security and Access Control

This domain tests identity, authorization and hardening: how users and services prove who they are, what they are then allowed to do, and how the platform records it. Expect permission arithmetic, certificate and key handling, and questions about least privilege in practice.

Core rules

• Authentication proves identity; authorization decides access; accounting records it. Directory integration (AD/LDAP) supplies the first, role-based access control supplies the second.
• RBAC should be scoped to the smallest role that permits the task; broad administrative roles defeat the model.
• chmod sets permissions for user, group and other; umask subtracts from the defaults (666 for files, 777 for directories) at creation time.
• SELinux and AppArmor enforce mandatory access control that overrides discretionary permissions when a context is wrong.
• Prefer SSH key pairs over passwords, and disable direct root login; use sudo for auditable elevation.
• TLS certificates expire: track expiry, use the correct SAN entries, and never trust self-signed certificates in production casually.

Worked example

With umask 027, a new file starts from 666 and has bits removed for group-write and all other access: 666 − 027 gives 640. A new directory starts from 777 and becomes 750. Reasoning: the mask is subtracted bitwise from the creation default, so the group keeps read and the world gets nothing.

Traps

Using chmod 777 to "fix" access; sharing the root account across administrators; embedding credentials in scripts and configuration files; leaving default or stale accounts enabled; forgetting that a renewed certificate still needs distributing to every endpoint.