1.6 Compare Access Control Models 200-201 Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A software company uses a code repository where each project lead controls access to their project's code. The security team wants to introduce a policy that prevents any user from accessing code from a project they are not a member of, even if the project lead grants access. The company also needs to log all access attempts. Which approach best satisfies both the existing flexibility and the new security policy?

   • AReplace DAC with MAC and label all code with project names
   • BKeep DAC for project leads, but add a mandatory rule that overrides any DAC grant if the user is not a project member, and enable accounting logs
   • CUse rule-based access control with a global rule allowing all project leads to grant access to anyone
   • DReplace DAC with RBAC and assign project membership as a role
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A defense contractor processes classified documents. The security policy requires that access be determined by comparing the user's security clearance with the classification label on each document, and that users cannot override these decisions. Which access control model enforces this requirement?

   • ARule-based access control with a rule that grants access to all users with a valid account
   • BMandatory access control (MAC) using labels and clearances
   • CRole-based access control (RBAC) with roles for each clearance level
   • DDiscretionary access control (DAC) where document owners set permissions
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A multinational company needs to control access to a document management system. The policy requires: (1) only employees in the 'legal' department can access contracts, (2) access is allowed only during business hours in the employee's local time zone, (3) access decisions must be centrally managed, and (4) every access attempt must be logged. The company currently uses RBAC with a 'legal' role. Which change is most appropriate?

   • AKeep RBAC but add a time-based rule that restricts access to a single global business hours window
   • BUse DAC and let each employee set their own access hours
   • CReplace RBAC with ABAC and configure policies that evaluate department, time-of-day, and local time zone, while retaining the existing accounting logs
   • DSwitch to MAC with labels for department and time zone
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A cloud storage service needs to allow access to a document only if the user is in the 'finance' department, the document is marked 'budget', and the current time is within business hours. Which access control model is best suited for this requirement?

   • AMandatory access control (MAC) with labels for department and document
   • BDiscretionary access control (DAC) where the document owner sets permissions
   • CRole-based access control (RBAC) with a 'finance' role
   • DAttribute-based access control (ABAC) with a policy combining subject, resource, and environment attributes
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   In the AAA framework, what does the 'Authentication' component verify?

   • AWho the user claims to be
   • BThe user's role in the organization
   • CWhat a user is allowed to do
   • DWhat actions the user performed
   Reveal Solution Discussion Select an answer first