Role-Based Access Control (RBAC) CSE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A developer requests access to a production database to troubleshoot an issue. The administrator knows the developer only needs to run SELECT queries for the next two hours. What is the most appropriate RBAC action?

   • AGrant the developer the 'db_owner' role for the database for two hours.
   • BAdd the developer to the existing 'Database Administrators' role permanently.
   • CCreate a temporary role with only the SELECT permission, assign the developer to it, and remove the assignment after two hours.
   • DShare the database administrator's credentials with the developer for two hours.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A financial institution is required by auditors to enforce separation of duties for payment processing. The RBAC system supports role hierarchies and multiple role assignments. The current design has a 'Payment Processor' role that includes both 'create payment' and 'approve payment' permissions, and a 'Payment Approver' role that inherits from 'Payment Processor'. The compliance team wants to enforce separation of duties without creating a new role hierarchy. Which change is required?

   • ACreate a new role 'Payment Creator' with only the create permission and assign it to all users who currently have 'Payment Processor'.
   • BKeep the current roles but add a policy that prevents the same user from being assigned to both roles.
   • CRemove the 'Payment Approver' role and rely on the 'Payment Processor' role to handle both actions.
   • DRemove the 'approve payment' permission from the 'Payment Processor' role and remove the inheritance so 'Payment Approver' only has the approve permission.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   In a cloud RBAC system, how can separation of duties be enforced?

   • ABy allowing users to create their own roles and assign permissions to themselves.
   • BBy using a single role that contains all necessary permissions for a task.
   • CBy regularly rotating passwords for all users.
   • DBy defining roles that are mutually exclusive, so a user cannot be assigned to both roles.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A company is moving from on-premises Active Directory to Azure. They want to grant a group of users the ability to manage virtual machines in a specific resource group, but they do not want to grant access to the entire subscription. Which Azure RBAC approach should they use?

   • AAdd the users directly to the VM's local administrators group through the Azure portal.
   • BAssign the 'Virtual Machine Contributor' role to the group at the resource group scope.
   • CAssign the 'Contributor' role to the group at the subscription scope.
   • DCreate a custom role that includes all actions on all resource types and assign it at the resource group scope.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A startup has a small cloud environment. The CEO asks the cloud administrator to give a new intern 'the same access as the senior developer' so the intern can start quickly. The administrator knows the intern only needs to view logs and restart a specific application. What should the administrator do?

   • ACreate a new role with only the log-read and application-restart permissions, then assign the intern to that role.
   • BGrant the intern temporary direct permissions on the log files and the application, and remove them after one week.
   • CCreate a role hierarchy where the intern's role inherits from the senior developer's role, then assign the intern to the lower role.
   • DAssign the intern to the senior developer's role because the CEO requested it and it is the fastest option.
   Reveal Solution Discussion Select an answer first