1.6 Compare Access Control Models 200-201 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which access control model is an example of nondiscretionary access control?

   • ADiscretionary Access Control (DAC)
   • BUser-based permissions in a home directory
   • CAccess Control Lists (ACLs) on a file
   • DRole-Based Access Control (RBAC)
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which characteristic is unique to Mandatory Access Control (MAC) compared to Discretionary Access Control (DAC)?

   • AAccess is granted based on job roles
   • BAccess decisions are based on a central policy that users cannot change
   • CUsers can grant access to their own files
   • DAccess is granted based on a set of rules
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A healthcare organization is implementing a new access control system. The compliance team requires that access to patient records be based on the user's role (e.g., nurse, doctor) AND the patient's consent status. The system must also log all access attempts. The organization wants to minimize administrative overhead by avoiding per-user permission assignments. Which approach is most appropriate?

   • AUse RBAC with a role for each possible combination of role and consent status
   • BUse MAC with labels for role and consent status
   • CUse ABAC with policies that combine role and patient consent attributes, and rely on the accounting component of AAA for logging
   • DUse DAC and let each patient set access permissions for their records
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A bank wants to give its tellers the ability to process deposits and withdrawals, but only during branch operating hours. Managers should have the same permissions plus the ability to approve large transactions. The bank wants to avoid managing permissions for each employee individually. Which access control approach is most efficient?

   • ADiscretionary access control (DAC) where each teller configures their own permissions
   • BMandatory access control (MAC) with labels for each transaction type
   • CRule-based access control with a global rule allowing all employees to process all transactions
   • DRole-based access control (RBAC) with roles for teller and manager, combined with time-based restrictions for the teller role
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which types of attributes are used in Attribute-Based Access Control (ABAC) to make access decisions?

   • AUser, group, and role
   • BSubject, resource, action, and environment
   • COwner, permission, and ACL
   • DClearance, label, and classification
   Reveal Solution Discussion Select an answer first