1.6 Compare Access Control Models 200-201 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which scenario best illustrates rule-based access control?

   • AA user can access a file because they are the owner
   • BA manager can approve purchase orders because of their job title
   • CA firewall blocks all traffic from a specific source IP address
   • DA user can access a document only if they have a top-secret clearance
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A startup uses a shared document repository where each team lead can grant access to their team's folders. The company wants to maintain this flexibility but also needs to log who accessed which document and when. Which approach should be taken?

   • AImplement MAC and require clearances for each folder.
   • BSwitch to RBAC and assign roles to team leads.
   • CUse ABAC with policies that include owner attributes.
   • DKeep DAC and enable auditing on the repository.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A defense contractor must enforce a policy where only users with a Top Secret clearance can read documents labeled Top Secret, regardless of who created the document. The security administrator needs a model that prevents even the document owner from overriding this restriction. Which access control model should be implemented?

   • AABAC, because attributes can include clearance and document label.
   • BMAC, because the system enforces access based on labels and clearances.
   • CRBAC, because roles can be assigned based on clearance levels.
   • DDAC, because the owner should control access to the documents they create.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   In a Discretionary Access Control (DAC) model, who is primarily responsible for deciding which subjects can access an object?

   • AThe central security policy engine
   • BThe resource owner
   • CThe system administrator
   • DThe security auditor
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A small marketing firm uses a shared network drive. Each department manager creates project folders and is responsible for deciding who can access them. The IT department wants to ensure that all access decisions are logged for compliance, but they do not want to be involved in day-to-day folder permissions. Which access control model matches this setup?

   • ARule-based access control with global rules for all project folders
   • BDiscretionary access control (DAC) with the managers as resource owners, plus a separate accounting system to log access events
   • CRole-based access control (RBAC) where IT assigns permissions based on job titles
   • DMandatory access control (MAC) with system-enforced labels on all folders
   Reveal Solution Discussion Select an answer first