Access Controls CCISO Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which of the following is an example of an access control implemented at the network layer?

   • AA file system ACL that grants read/write permissions to a user
   • BA database view that restricts columns a user can see
   • CA firewall rule that allows traffic only from specific IP addresses
   • DA password policy that requires complex passwords
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   In the context of authorization, what is a 'permission'?

   • AThe process of verifying a user's identity
   • BA physical token used to gain access to a building
   • CThe record of user actions in an audit log
   • DA specific action that a subject is allowed to perform on an object, such as read, write, or execute
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is the primary security advantage of multi-factor authentication (MFA) over single-factor authentication?

   • AIt speeds up the authentication process by using multiple factors simultaneously
   • BIt requires the user to provide two or more different types of authentication factors, making unauthorized access more difficult
   • CIt eliminates the need for passwords entirely
   • DIt ensures that the user is physically present at the device
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A financial firm is implementing a new access control system. The CISO requires that each user must first prove their identity, then the system must verify that the user is allowed to perform a specific transaction. Additionally, the system must log every transaction to a user. Which IAAA components are being described in order?

   • AIdentification, Authentication, Authorization, Accountability
   • BAuthentication, Identification, Authorization, Accountability
   • CIdentification, Authentication, Accountability, Authorization
   • DIdentification, Authorization, Authentication, Accountability
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A government agency is deploying a new system that handles classified documents. The security policy requires that access decisions are based on the document's classification level and the user's security clearance. Additionally, the policy requires that a user cannot declassify a document unless they have a specific 'declassifier' attribute. Which access control model should be selected?

   • AAttribute-based access control (ABAC) with only the user's department as an attribute.
   • BRole-based access control (RBAC) with roles for each clearance level.
   • CDiscretionary access control (DAC) where the document owner decides who can access it.
   • DMandatory access control (MAC) with labels for classification and a separate attribute for declassification rights.
   Reveal Solution Discussion Select an answer first