Identity and Access Management (IAM) Concepts NDE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A defense contractor is implementing access control for a document management system. The system must enforce that only personnel with a 'Top Secret' clearance can access documents labeled 'Top Secret', and this decision must be made by the system, not by individual users. Additionally, the contractor wants to allow project managers to grant access to project folders for their team members, but only within the same project. Which access control models should be combined to meet these requirements?

   • ARole-based access control (RBAC) for both document classification and project folder sharing.
   • BDiscretionary access control (DAC) for document classification and mandatory access control (MAC) for project folder sharing.
   • CAttribute-based access control (ABAC) for both, using attributes for clearance and project membership.
   • DMandatory access control (MAC) for document classification and discretionary access control (DAC) for project folder sharing.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company is considering implementing SSO for its employees. The IT team is concerned about the risk of a single compromised password granting access to all applications. Which additional control should be implemented to mitigate this risk?

   • AEnforce multi-factor authentication (MFA) on the SSO identity provider.
   • BDisable SSO and require separate passwords for each application.
   • CUse longer passwords for all applications.
   • DImplement session timeouts for each application.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A hospital wants to ensure that only nurses can view patient records and only doctors can update treatment plans. The system should automatically grant these permissions based on the user's job title. Which authorization model best fits this requirement?

   • AAttribute-based access control (ABAC)
   • BMandatory access control (MAC)
   • CRole-based access control (RBAC)
   • DDiscretionary access control (DAC)
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A university partners with a research institute. Researchers from the institute need to access the university's online library using their institute credentials. The university does not want to create separate accounts for each researcher. Which approach should the university use?

   • AUse OAuth to allow researchers to share their university passwords.
   • BCreate guest accounts for each researcher and email them credentials.
   • CSet up a VPN that gives researchers access to the university network.
   • DEstablish federated identity management using SAML.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A small company uses a shared network drive where each employee can create folders and decide who can access those folders. The company wants to move to a model where access is determined centrally by the IT department based on job roles. Which access control model should they adopt?

   • ADiscretionary access control (DAC) where folder owners continue to decide access.
   • BAttribute-based access control (ABAC) where access is based on attributes like department and time.
   • CRole-based access control (RBAC) where IT assigns permissions to roles and employees are placed in roles.
   • DMandatory access control (MAC) where security labels are applied to all files and users.
   Reveal Solution Discussion Select an answer first