Role-Based Access Control (RBAC) CSE Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A company has a high rate of employee turnover. They want to ensure that when an employee leaves, their cloud access is revoked quickly and completely. They also want to avoid accumulating unused roles. Which RBAC best practice addresses this?

   • AKeep role assignments for 30 days after an employee leaves to allow for re-hiring.
   • BAssign all employees to a single 'Employee' role and remove it when they leave.
   • CManually remove role assignments when an employee leaves, and periodically review all roles.
   • DUse a centralized identity lifecycle management process that automatically removes role assignments when an employee's account is deactivated.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A company is implementing RBAC for a procurement system. They have a requirement that a user cannot both create a purchase order and approve it. They also have a requirement that a user cannot both approve a purchase order and receive the goods. The RBAC system supports role hierarchies. Which design enforces both separation of duties constraints?

   • ACreate a single role 'Procurement' that includes all three permissions and rely on the application to enforce separation.
   • BCreate a role hierarchy where 'PO Approver' inherits from 'PO Creator', and 'Goods Receiver' inherits from 'PO Approver'.
   • CCreate three roles: 'PO Creator', 'PO Approver', and 'Goods Receiver'. Ensure no user is assigned to more than one of these roles.
   • DCreate two roles: 'PO Creator' and 'PO Approver', and allow the 'Goods Receiver' to be the same as the 'PO Approver'.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A cloud security team is designing RBAC roles for a financial application. The same person must never be able to both create a vendor invoice and approve that invoice for payment. Which RBAC design decision directly enforces this requirement?

   • ACreate a single role that includes both invoice-creation and invoice-approval permissions, then rely on the application to block the same user from acting twice.
   • BGrant the invoice-creation permission to all users and the invoice-approval permission only to the finance manager.
   • CAssign the invoice-approval permission to a role that is senior to the invoice-creation role in the role hierarchy.
   • DAssign the invoice-creation permission and the invoice-approval permission to two separate roles, and ensure no user holds both roles.
   Reveal Solution Discussion Select an answer first
5. 29expert · medium

   An organization is designing a role hierarchy for a software development team. They have the following roles: 'Engineer', 'Senior Engineer', and 'Tech Lead'. The 'Senior Engineer' role should inherit from 'Engineer', and the 'Tech Lead' role should inherit from 'Senior Engineer'. The 'Engineer' role has permissions to deploy to staging. The 'Senior Engineer' role adds permissions to deploy to production. The 'Tech Lead' role adds permissions to manage team members. Which statement about the effective permissions of a user assigned to the 'Tech Lead' role is correct?

   • AThe user has the permissions of Engineer and Senior Engineer but not the Tech Lead's own permissions.
   • BThe user has all permissions of Engineer, Senior Engineer, and Tech Lead, including staging deploy, production deploy, and team management.
   • CThe user has only the permissions explicitly assigned to the Tech Lead role.
   • DThe user has only the permissions of the Engineer role because the hierarchy is not transitive.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A company operates in both AWS and Azure. In AWS, they use IAM roles with inline policies for a legacy application. In Azure, they use built-in roles. The company is standardizing on least privilege and wants to reduce the number of custom policies. Which approach best achieves this across both providers?

   • AIn AWS, keep inline policies because they are scoped to a single role; in Azure, create custom roles for every job function.
   • BIn AWS, create a single managed policy that grants all permissions; in Azure, use the Contributor role for everyone.
   • CIn AWS, use the AdministratorAccess managed policy for all roles; in Azure, assign the Owner role to all users.
   • DIn AWS, replace inline policies with managed policies and reuse them across roles; in Azure, use built-in roles where possible and create custom roles only when necessary.
   Reveal Solution Discussion Select an answer first