Access Controls CCISO Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A hospital's IT team is configuring a new electronic health record (EHR) system. The compliance officer requires that nurses can view patient records but cannot modify them, while physicians can both view and modify. The system also requires that a nurse can temporarily escalate to modify a record in an emergency, but the action must be logged and reviewed. Which authorization approach best meets these requirements?

   • AUse role-based access control (RBAC) with roles for nurse and physician, and implement a break-glass procedure that grants temporary modify rights with mandatory logging.
   • BUse attribute-based access control (ABAC) with only the user's department as an attribute.
   • CUse mandatory access control (MAC) with labels for patient records.
   • DUse discretionary access control (DAC) where each physician can grant modify rights to any nurse.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A financial services firm needs to grant access to a document management system. The compliance team requires that access decisions consider the user's department, the document's classification, and the current time (business hours only). The system must also allow a manager to temporarily grant a contractor access to a specific document for a project. Which access control model best meets these requirements?

   • AAttribute-based access control (ABAC) with policies that evaluate department, classification, and time, plus a break-glass policy for temporary access.
   • BMandatory access control (MAC) with labels for classification and a separate process for temporary access.
   • CRole-based access control (RBAC) with roles for each department and a separate role for contractors.
   • DDiscretionary access control (DAC) where the document owner sets permissions for each user.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is an example of an access control monitoring technique?

   • AEncrypting the hard drive of the server
   • BInstalling a firewall to block external traffic
   • CCreating a backup of the access control list
   • DSetting up alerts for multiple failed login attempts on a critical system
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which component of the IAAA framework is responsible for ensuring that user actions can be traced back to an individual?

   • AAccountability
   • BIdentification
   • CAuthentication
   • DAuthorization
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company is considering implementing MFA for all users. The CISO is concerned about user resistance and wants to choose a method that balances security and usability. The company has a mix of desktop users and field workers who use company-owned smartphones. Which MFA method is most appropriate?

   • AUse biometric authentication on personal devices.
   • BUse push notifications to a mobile authenticator app on company-owned smartphones.
   • CUse SMS one-time passcodes (OTP) to personal phones.
   • DIssue hardware tokens to every user.
   Reveal Solution Discussion Select an answer first