2.4 - Understand and Administer Access Controls SSCP Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A hospital is implementing an electronic health record (EHR) system. Nurses need to view and update patient records for patients assigned to their ward. Physicians need to view records for all patients in the hospital but only update records for patients they are actively treating. Lab technicians need read-only access to records for patients with pending lab orders. The compliance officer insists that access decisions must be based on the staff member's job function, not on individual user preferences or object ownership. Which access control model should the hospital implement?

   • ADiscretionary Access Control (DAC) where each physician owns the records they create
   • BRole-Based Access Control (RBAC) with roles for Nurse, Physician, and Lab Technician
   • CAttribute-Based Access Control (ABAC) using only the user's department as an attribute
   • DRule-Based Access Control with rules that allow access only during business hours
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A cloud storage provider needs to grant access to a document based on multiple factors: the user's department, the document's sensitivity level, and whether the user is accessing from a trusted corporate device. The policy must be evaluated dynamically at the time of each access request. Which access control model is best suited for this requirement?

   • AAttribute-Based Access Control (ABAC)
   • BDiscretionary Access Control (DAC)
   • CRole-Based Access Control (RBAC)
   • DMandatory Access Control (MAC)
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   In Role-Based Access Control (RBAC), how is access to a resource typically determined?

   • ABy the user's IP address
   • BBy the role assigned to the user
   • CBy the owner's discretion for each user
   • DBy the security label of the resource
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   In a system implementing Mandatory Access Control (MAC), which entity is responsible for making the final access decision?

   • AThe user, who can change the security label of an object they created
   • BThe resource owner, who sets permissions for each user
   • CThe network administrator, who grants access based on IP addresses
   • DThe system, based on comparing security labels and user clearances
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A defense contractor processes documents classified as CONFIDENTIAL and SECRET. The security policy states that a user with a SECRET clearance can read SECRET and CONFIDENTIAL documents, but a user with only CONFIDENTIAL clearance cannot read SECRET documents. The system must enforce this policy centrally, and users must not be able to change the classification of a document or grant access to another user. Which access control model enforces this requirement?

   • AAttribute-Based Access Control (ABAC) with a rule that allows access if the user's name is on an access list
   • BDiscretionary Access Control (DAC) with the document owner setting permissions
   • CRule-Based Access Control with a rule that blocks SECRET documents after 5 PM
   • DMandatory Access Control (MAC) with security labels on subjects and objects
   Reveal Solution Discussion Select an answer first