5.4 - Implement and Manage Authorization Mechanisms CISSP Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   In Role-Based Access Control (RBAC), what is the primary factor that determines the permissions a user receives?

   • AThe attributes of the user, resource, and current environment
   • BThe roles assigned to the user and the permissions authorized for those roles
   • CThe user's identity and the specific objects they request
   • DThe security labels of the user and the classification of the data
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   A company wants to allow employees to access the building's Wi-Fi only during business hours (9 AM to 5 PM) and only from within the office. Which access control model best fits this requirement?

   • ARole-Based Access Control (RBAC)
   • BDiscretionary Access Control (DAC)
   • CRule-Based Access Control
   • DMandatory Access Control (MAC)
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which mechanism is commonly used to implement Discretionary Access Control (DAC)?

   • ASecurity labels and clearances
   • BAccess control lists (ACLs)
   • CRule sets
   • DRole assignments
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A financial services firm wants to restrict access to its trading application based on the user's IP address and the time of day. The security team needs a solution that evaluates these conditions dynamically for each access request and can be updated without modifying the application code. Which access control approach best meets this requirement?

   • AUse attribute-based access control with user attributes only
   • BDeploy a policy decision point (PDP) that evaluates rules for each request and a policy enforcement point (PEP) in the application
   • CImplement rule-based access control at the network firewall
   • DConfigure the application to check user roles before granting access
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A financial institution is implementing a risk-based access control system. The system must allow a user to perform a high-value transaction if the risk score is below a threshold, but require step-up authentication if the risk score is above the threshold. The institution also wants to ensure that the risk score is calculated consistently across all access requests. Which architecture is most appropriate?

   • AImplement a centralized PDP that calculates risk scores and returns a decision to the PEP in each application
   • BUse RBAC with high-risk roles
   • CImplement risk calculation in each application separately
   • DUse a static rule-based system with fixed thresholds
   Reveal Solution Discussion Select an answer first