5.4 - Implement and Manage Authorization Mechanisms CISSP Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A hospital is implementing a new electronic health record (EHR) system. The compliance team requires that access to patient records be granted based on the user's job function (e.g., nurse, physician, pharmacist) and that no individual user can grant access to another user. The system must also enforce that a user's permissions are automatically updated when their job role changes. Which access control model should the hospital implement?

   • ARule-Based Access Control with time-of-day restrictions
   • BDiscretionary Access Control (DAC) with user-managed ACLs
   • CAttribute-Based Access Control (ABAC) with user-defined attributes
   • DRole-Based Access Control (RBAC) with centrally managed role assignments
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   In Attribute-Based Access Control (ABAC), what is the basis for making access decisions?

   • AThe attributes of the subject, object, and environment
   • BThe clearance level of the subject
   • CThe owner's discretion
   • DThe roles assigned to the user
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following best describes the relationship between role assignment and permission authorization in RBAC?

   • ARole assignment is performed by the data owner; permission authorization is performed by the system administrator.
   • BRole assignment grants permissions directly to users; permission authorization defines the role's name.
   • CRole assignment is only for temporary access; permission authorization is for permanent access.
   • DRole assignment determines which roles a user can hold; permission authorization defines what actions those roles can perform.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   In Mandatory Access Control (MAC), what determines whether a subject can access an object?

   • AThe subject's role and the permissions associated with that role
   • BA set of rules based on time-of-day and location
   • CThe subject's clearance level compared to the object's classification label
   • DThe object owner's decision to grant access to the subject
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A multinational corporation is implementing a new ERP system. The security team must ensure that users in the finance department can access financial modules, but only during business hours in their local time zone. The company also wants to minimize administrative overhead by avoiding the creation of separate roles for each time zone. Which approach best meets these requirements?

   • AUse MAC with a 'Finance' clearance and a 'Business Hours' classification
   • BUse RBAC for finance role and rule-based access control for time-of-day restrictions
   • CUse ABAC with attributes for role and time zone, but require a separate policy for each time zone
   • DCreate a separate role for each time zone and assign users accordingly
   Reveal Solution Discussion Select an answer first