Access Controls ACCISO Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In a Discretionary Access Control (DAC) model, who is typically allowed to grant access to an object?

   • AThe security policy engine
   • BA central security authority
   • CThe owner of the object
   • DThe system administrator only
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A university is deploying a new learning management system (LMS). Instructors should be able to grade only their own courses, teaching assistants can grade only the courses they are assigned to, and students can only view their own grades. The LMS supports role-based access control. What is the most effective way to configure the LMS?

   • AUse the LMS's default role assignments and rely on the course enrollment data to limit access.
   • BCreate roles for Instructor, Teaching Assistant, and Student, and assign each user to the appropriate role.
   • CCreate roles and then configure course-level permissions so each role's access is scoped to the assigned courses.
   • DAssign each user a custom permission set based on their job title.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A healthcare organization is implementing a new electronic health record (EHR) system. The system must allow nurses to view patient records for patients in their ward, but only during their shift. Physicians can view records for patients they are treating, regardless of shift. The organization also needs to audit all access to patient records. Which access control model should be selected?

   • AABAC with policies that evaluate the user's role, the patient's ward, the treating-physician relationship, and the current shift time.
   • BDAC where each nurse can grant access to other nurses.
   • CRBAC with roles for Nurse and Physician, and rely on the EHR application to enforce shift and ward restrictions.
   • DMAC with security labels for patient records and user clearances.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An employee has been promoted from a sales role to a manager role. The identity management team is updating the user's role in the HR system. What is the most important additional step to ensure the user's access reflects the new role?

   • ARemove the user's old role assignments and grant the new manager role permissions.
   • BKeep the old role assignments and add the new manager role to avoid disruption.
   • CWait for the next scheduled access review to update the user's roles.
   • DAsk the user which permissions they need and update accordingly.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security analyst notices repeated failed login attempts to a legacy application followed by a successful login from a new IP address. The analyst wants to determine whether the account was compromised and whether any data was accessed. Which action should the analyst take first?

   • ADisable the account immediately and require the user to change their password.
   • BReset the account password and force a re-authentication at the next login.
   • CAdd the new IP address to the firewall blocklist to prevent further access.
   • DReview the application's audit logs for the account's activity after the successful login, including accessed records and performed actions.
   Reveal Solution Discussion Select an answer first