1.6 Compare Access Control Models 200-201 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A cloud storage service needs to grant access to files based on the user's department, the file's sensitivity level, the action being performed (read or write), and the current time of day. The policy must be flexible enough to combine these factors. Which access control model is best suited?

   • ADAC, because file owners can set permissions based on all factors.
   • BMAC, because labels can represent all these factors.
   • CRBAC, because roles can incorporate all these factors.
   • DABAC, because policies can use subject, resource, action, and environment attributes.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A financial institution wants to grant access to a trading platform based on the user's certification level, the current market volatility, and the user's location (office vs remote). The policy must be centrally managed and all access decisions must be logged. Which access control model is best suited?

   • AMAC with labels for certification and location
   • BRBAC with a role for each certification level
   • CABAC with policies that evaluate certification, market volatility, and location, plus accounting logs
   • DRule-based access control with a global rule allowing all certified users
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the primary purpose of time-based access control?

   • ATo track how long a user is logged in
   • BTo restrict access to specific hours or days
   • CTo enforce password expiration
   • DTo limit the amount of data a user can download
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   In rule-based access control, what is the basis for granting or denying access?

   • AA set of global rules that apply to all subjects
   • BThe sensitivity label of the object
   • CThe subject's role in the organization
   • DThe resource owner's discretion
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A university IT department wants to standardize access to administrative systems. They plan to centrally define permissions based on job functions (e.g., registrar, advisor, bursar) and remove the ability of individual staff to grant access to others. Which access control model should they implement?

   • ARule-based access control with a global rule allowing all staff access
   • BNondiscretionary access control with centralized management, such as role-based access control (RBAC)
   • CDiscretionary access control (DAC) where each staff member controls their own files
   • DTime-based access control that limits access to business hours
   Reveal Solution Discussion Select an answer first