Access Controls ACCISO Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which access control model uses labels such as 'Top Secret' and 'Confidential' to enforce a centralized, hierarchical policy?

   • AAttribute-Based Access Control (ABAC)
   • BMandatory Access Control (MAC)
   • CRole-Based Access Control (RBAC)
   • DDiscretionary Access Control (DAC)
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A compliance officer wants to ensure that only authorized personnel can access the company's HR database. The database logs all access attempts. Which practice would provide the most reliable evidence of authorized access?

   • AImplementing real-time alerting on any access attempt from an account not in the authorized user list.
   • BEnabling detailed audit logging and periodically reconciling the logs with the access control list and user access reviews.
   • CReviewing the database access logs monthly and comparing them against the current employee directory.
   • DRequiring all users to use multi-factor authentication and assuming that successful authentication implies authorization.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following best describes the role of access control in protecting information assets?

   • AIt ensures that all data is available to authorized users at all times
   • BIt verifies the identity of users before they can log in to a system
   • CIt prevents all unauthorized disclosure, alteration, and destruction of data
   • DIt enforces the organization's security policy by granting or denying specific access requests
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which of the following is an example of an access control monitoring activity?

   • AReviewing failed login attempts to identify brute-force attacks
   • BSetting password complexity requirements
   • CDefining user roles in an RBAC system
   • DEncrypting sensitive files
   Reveal Solution Discussion Select an answer first
6. 15expert · medium

   A large enterprise is merging with another company. The security team must integrate the two identity management systems. The merged company will have overlapping job functions, and some employees will have access to sensitive data from both legacy systems. The team must ensure that access rights are reviewed and consolidated without disrupting business operations. Which approach best balances security and operational continuity?

   • AKeep both legacy systems and manually reconcile access rights in a spreadsheet
   • BUse a federated identity solution and conduct a joint access review before granting cross-system access
   • CMigrate all users to a new identity management system and assign permissions based on new roles
   • DGrant all users the highest level of access from both systems temporarily
   Reveal Solution Discussion Select an answer first