5.4 - Implement and Manage Authorization Mechanisms CISSP Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A university is implementing a new library system. The policy requires that students can access e-books only if they are enrolled in a course that uses the e-book, the access is during the semester, and the student is not on a disciplinary hold. The system must evaluate these conditions for each access request. Which access control model is most appropriate, and what is a key consideration?

   • ADAC with the instructor setting permissions
   • BMAC with a 'Student' clearance and an 'E-book' classification
   • CABAC with policies that combine attributes from the student, the e-book, and the environment
   • DRBAC with a 'Student' role and a 'Course' role
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A small design firm uses a shared file server. The owner of each project folder wants to be able to grant or revoke access to individual colleagues without involving the IT department. The firm also wants to keep the ability for the owner to delegate access control to a project lead if needed. Which access control model should be implemented?

   • ARole-Based Access Control (RBAC) with IT-managed roles
   • BDiscretionary Access Control (DAC) with ACLs
   • CRule-Based Access Control with time-based rules
   • DMandatory Access Control (MAC)
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which characteristic is unique to Mandatory Access Control (MAC) compared to other access control models?

   • AAccess decisions are based on a set of predefined rules.
   • BThe system enforces access based on labels and clearances, and users cannot override it.
   • CThe object owner has full control over who can access the object.
   • DPermissions are assigned to roles, and users inherit them through role assignment.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A government agency is implementing a new document management system. The security policy requires that access be based on the user's clearance level and the document's classification. Additionally, the agency wants to ensure that a user with a Top Secret clearance cannot write to a Secret document, even if they are the author. Which access control model and property should be implemented?

   • AABAC with clearance and classification attributes
   • BMAC with the *-property (no write down)
   • CDAC with owner-set permissions
   • DRBAC with a 'Top Secret' role and a 'Secret' role
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   How do the Policy Decision Point (PDP) and Policy Enforcement Point (PEP) interact in an access control system?

   • AThe PEP authenticates the user, and the PDP authorizes access without further interaction.
   • BThe PDP and PEP are combined into a single component that both evaluates and enforces policies.
   • CThe PEP evaluates the policy and sends the decision to the PDP, which enforces it.
   • DThe PDP evaluates the policy and sends the decision to the PEP, which enforces it.
   Reveal Solution Discussion Select an answer first