Access Control Principles, Terminologies, and Models NDE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A hospital is implementing a new access control system. The system must ensure that patient records are only accessible to authorized medical staff (confidentiality), that records cannot be altered by unauthorized users (integrity), and that the system remains available during emergencies (availability). The hospital also needs to comply with regulations that require logging of all access to patient records. Which access control principle is most directly supported by the logging requirement?

   • AIntegrity, because logging ensures data is not modified
   • BAvailability, because logging ensures the system is up
   • CConfidentiality, because logging prevents unauthorized access
   • DAccountability, because logging provides a trail of who accessed what
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A multinational corporation needs to implement access control for its cloud-based document management system. The system must enforce data residency requirements (documents must remain in specific geographic regions), support dynamic access decisions based on user location and device security posture, and allow resource owners to grant temporary access to external collaborators. Which access control model is best suited to meet all these requirements?

   • ARole-Based Access Control (RBAC)
   • BMandatory Access Control (MAC)
   • CAttribute-Based Access Control (ABAC)
   • DDiscretionary Access Control (DAC)
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A government agency requires that all access decisions be based on security labels and clearances, and that no user can change the label of a document. However, the agency also needs to allow analysts to share documents with each other temporarily. Which approach best satisfies both requirements?

   • AImplement RBAC, and assign temporary roles for sharing
   • BImplement ABAC, and use dynamic attributes for sharing
   • CImplement DAC, and rely on user discretion for sharing
   • DImplement MAC, but create temporary label categories for project sharing
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A user named Alice is a member of the 'Sales' group. The Sales group has 'Read' permission on the 'Q3_Report' file. Alice also has an individual 'No Access' permission on the same file. The system uses a deny-overrides policy. What is Alice's effective access to the Q3_Report file?

   • ARead access, because group permissions apply to all members
   • BNo access, because Alice is not the owner of the file
   • CNo access, because the explicit deny overrides the group allow
   • DRead access, because individual permissions are always ignored when group permissions exist
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   A military system uses security labels such as 'Top Secret' and 'Secret' to control access to classified documents. Which access control model is being used?

   • AMandatory Access Control (MAC)
   • BDiscretionary Access Control (DAC)
   • CRole-Based Access Control (RBAC)
   • DAttribute-Based Access Control (ABAC)
   Reveal Solution Discussion Select an answer first