3.2 - Understand Logical Access Controls CC Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A small accounting firm wants to reduce the risk of fraud in its payment process. Currently, one employee both creates vendor invoices and approves payments. The firm has only five employees and cannot hire additional staff. What is the best control to implement?

   • ARequire that a different employee approve each payment before it is processed.
   • BUse a single sign-on system to simplify access for all employees.
   • CImplement a policy that all invoices must be reviewed by the same employee who created them to ensure accuracy.
   • DGrant the employee who creates invoices the ability to also approve payments, but require a second password.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A financial services company is implementing a new trading system. Traders need to execute trades, but they should not be able to modify the system's configuration or approve their own trades. The company wants to minimize the risk of unauthorized trading and ensure that no single individual has excessive control. What is the most effective combination of controls?

   • AGrant traders full access to the system, but require a second person to review all trades after execution.
   • BImplement role-based access control (RBAC) with separate roles for traders and trade approvers, and apply the principle of least privilege to each role.
   • CUse discretionary access control (DAC) so that traders can set permissions on their own trade files.
   • DImplement mandatory access control (MAC) with security labels for all trades.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   In role-based access control (RBAC), how are permissions assigned?

   • APermissions are assigned based on security labels and clearances.
   • BPermissions are assigned to roles, and users are then assigned to those roles.
   • CPermissions are assigned based on the resource owner's discretion.
   • DPermissions are assigned directly to individual users.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A mid-sized company is implementing a new procurement system. The system should allow employees to request purchases, managers to approve requests, and the finance department to process payments. The company wants to prevent any single employee from both requesting and approving a purchase, and also wants to ensure that employees have only the access needed for their job. The company has limited IT staff to manage user permissions. What is the best approach?

   • AImplement role-based access control (RBAC) with roles for 'Requester', 'Approver', and 'Finance', and assign users to these roles.
   • BUse discretionary access control (DAC) so that each employee can set permissions on their own requests.
   • CGrant all employees the same level of access to the system to simplify management.
   • DAssign permissions individually to each employee based on their specific job duties.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A retail company has a new point-of-sale system. Cashiers need to process sales, managers need to override transactions and view sales reports, and IT administrators need to configure the system. The company wants to simplify access management and ensure that employees have only the access needed for their job. What is the best approach?

   • AGive all employees the same level of access to simplify management.
   • BCreate roles for 'Cashier', 'Manager', and 'IT Admin' with appropriate permissions, and assign employees to these roles.
   • CUse a mandatory access control system with security labels for all employees.
   • DAssign permissions individually to each employee based on their specific needs.
   Reveal Solution Discussion Select an answer first