Access Controls ACCISO Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A hospital is implementing an access control system for its electronic health record (EHR) application. Nurses need to view patient records for patients on their assigned ward, but only during their scheduled shift. Physicians need broader access to records for patients they are treating, and administrators need access only for audit purposes. The system must enforce these rules dynamically based on the user's current role, the patient's location, and the time of day. Which access control model best meets these requirements?

   • ADiscretionary Access Control (DAC)
   • BAttribute-Based Access Control (ABAC)
   • CMandatory Access Control (MAC)
   • DRole-Based Access Control (RBAC)
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security analyst notices that a user's account has been logging in at unusual hours and accessing files outside their normal job function. The analyst suspects the account may be compromised. Which immediate action should the analyst take to limit potential damage?

   • ASend an alert to the user and ask them to verify the activity
   • BReview the audit logs to determine the extent of the access
   • CChange the user's password and require re-authentication
   • DDisable the user account and begin a forensic investigation
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   In a typical operating system, how is access control commonly implemented for files and directories?

   • ABy encrypting each file with a unique key
   • BBy storing all files in a database with SQL queries
   • CBy requiring a digital signature for every file access
   • DBy using file permissions and ACLs that specify which users or groups can read, write, or execute
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company is implementing access control for a web application. They need to ensure that users can only access their own profile data and that administrators can access all profiles. The application uses a database to store user information. Which access control mechanism should be implemented at the application layer?

   • ANetwork-level access control lists (ACLs) on the database server
   • BOperating system file permissions on the database files
   • CApplication-level authorization checks in the code
   • DDatabase-level permissions for each user
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A system administrator is configuring a Linux server that hosts a web application. The application needs to read a configuration file, but the application runs as a non-root user. The administrator wants to grant the application user read access to the file without giving the user any other permissions on the directory. Which mechanism should the administrator use?

   • AUse a capability such as CAP_DAC_READ_SEARCH on the application binary.
   • BAdd the application user to the root group.
   • CChange the file's owner to the application user.
   • DSet the file's group ownership to a group the application user belongs to and set the group read permission.
   Reveal Solution Discussion Select an answer first