Identification, Authentication, and Authorization CCT Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A hospital wants to ensure that only nurses in the cardiology department can access the electronic health records (EHR) system, and only during their scheduled shifts. The system already authenticates users with smart cards. Which authorization model best meets this requirement?

   • AMAC — assign classification labels to EHR data and clearances to users
   • BRBAC — assign roles like 'Cardiology Nurse' and define shift-based permissions
   • CABAC — use attributes such as department, role, and time of day in access policies
   • DDAC — let each nurse set permissions on the EHR folders they create
   Reveal Solution Discussion Select an answer first
2. 7application · easy

   A user claims to be 'jsmith' and provides the correct password. The system then checks the user's account to see if 'jsmith' is allowed to access the payroll application. Which sequence of security controls is being performed?

   • AIdentification, then authorization, then authentication
   • BAuthorization, then authentication, then identification
   • CIdentification, then authentication, then authorization
   • DAuthentication, then identification, then authorization
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company is choosing an authentication method for employees who frequently work from public Wi-Fi. They are concerned about credential theft and want a method that is resistant to phishing and does not rely on a shared secret that can be intercepted. Which method is the best choice?

   • ATOTP mobile app
   • BSMS one-time passcode
   • CHardware security key using WebAuthn
   • DPassword with complexity requirements
   Reveal Solution Discussion Select an answer first
5. 9application · easy

   A user attempts to access a system by entering 'alice' as their username. The system then prompts for a password. After verifying the password, the system checks if 'alice' is in the 'managers' group to allow access to a shared folder. Which step is the identification step?

   • AAccessing the shared folder
   • BEntering the password
   • CEntering the username 'alice'
   • DChecking group membership
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the purpose of authorization in a security system?

   • ATo verify the user's identity
   • BTo determine what resources and actions an authenticated user is allowed to access
   • CTo create a new user account
   • DTo encrypt data in transit
   Reveal Solution Discussion Select an answer first