3.2 - Understand Logical Access Controls CC Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A hospital's IT department is configuring access for a new nurse who works only in the cardiology ward during the day shift. The nurse needs to view patient records for cardiology patients but should not access records for other departments. The hospital uses a centralized identity management system. What is the most appropriate way to grant access?

   • AAdd the nurse to the existing 'Physician' role, which includes read/write access to all patient records.
   • BGrant the nurse direct read access to all patient records in the system, since the nurse is a licensed medical professional.
   • CProvide the nurse with a temporary administrative account that has full access for the day shift.
   • DCreate a new role named 'Cardiology Day Nurse' with permissions to view cardiology patient records and assign the nurse to this role.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A marketing department uses a shared network drive to store campaign assets. The team lead, who created the folder structure, wants to allow the graphic designers to edit files but only allow the rest of the marketing team to view them. The company uses a file server where the folder owner can set permissions. What is the most appropriate access control model to use?

   • AAttribute-based access control (ABAC), because access should be based on user attributes like department.
   • BRole-based access control (RBAC), because permissions should be assigned to roles like 'Designer' and 'Viewer'.
   • CDiscretionary access control (DAC), because the folder owner can grant different levels of access to different users.
   • DMandatory access control (MAC), because the system should enforce access based on security labels.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is a characteristic of discretionary access control (DAC)?

   • AAccess is granted based on the user's clearance level.
   • BAccess decisions are based on security labels and clearances.
   • CPermissions are assigned to roles rather than individuals.
   • DUsers can grant access to resources they own to other users.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which statement best describes the principle of least privilege?

   • AUsers are granted access based on the sensitivity of the data they handle.
   • BUsers are granted access to all resources by default and then restrictions are applied.
   • CUsers are granted access based on the discretion of the resource owner.
   • DUsers are granted the minimum level of access required to perform their job duties.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A government agency handles classified documents. The system must ensure that only personnel with the appropriate security clearance can access documents labeled 'Top Secret'. The access decision must be based on the classification label of the document and the clearance of the user, not on the discretion of individual users. Which access control model should be implemented?

   • AAttribute-based access control (ABAC)
   • BDiscretionary access control (DAC)
   • CMandatory access control (MAC)
   • DRole-based access control (RBAC)
   Reveal Solution Discussion Select an answer first