1.6 Compare Access Control Models 200-201 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An organization wants to ensure that only authenticated users can access its VPN, that each user is limited to the resources their role permits, and that all login attempts are recorded for security review. Which combination of AAA components addresses these requirements?

   • AAuthentication only, because it verifies identity and implicitly grants access
   • BAuthorization only, because it defines what users can do after login
   • CAuthentication to verify identity, authorization to enforce role-based permissions, and accounting to log login attempts
   • DAccounting only, because it records all events and can be used to infer access
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is a key advantage of Role-Based Access Control (RBAC) over Discretionary Access Control (DAC)?

   • ARBAC is always more secure than DAC
   • BRBAC simplifies administration by managing permissions at the role level
   • CRBAC allows users to share files easily
   • DRBAC uses labels to enforce security
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   In Role-Based Access Control (RBAC), how are permissions assigned to users?

   • AThrough roles that users are assigned to
   • BBased on the sensitivity labels of the resources
   • CDirectly to each user individually
   • DBased on the owner's discretion for each file
   Reveal Solution Discussion Select an answer first
5. 9application · easy

   A software company wants to simplify permission management by assigning access based on job functions such as developer, tester, and manager. The security team will centrally define which permissions each role has, and employees will be assigned to roles. Which access control model should be implemented?

   • AMAC, because labels are needed for each job function.
   • BABAC, because attributes can include job title.
   • CRBAC, because permissions are assigned to roles and users are mapped to roles.
   • DDAC, because each employee should control their own permissions.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A government agency is migrating from a legacy system that used DAC, where each file owner set permissions. The new system must enforce a classification policy (e.g., 'Top Secret' files can only be read by users with a 'Top Secret' clearance) and prevent users from downgrading file classifications. However, the agency also needs to allow project leads to grant access to their own project files for collaboration. Which approach best satisfies both requirements?

   • AImplement MAC for classified files, and use DAC for unclassified project files, with a clear separation between the two domains
   • BUse RBAC with roles for each clearance level and let project leads assign roles
   • CUse rule-based access control with a global rule that grants access based on file name
   • DUse MAC for all files, including project files, and remove owner discretion entirely
   Reveal Solution Discussion Select an answer first