Access Controls Concepts

An organization wants to implement the principle of least privilege for its database administrators. Which approach best achieves this goal?

A security auditor discovers that a user has been granted read and write access to a sensitive file, but the user's job only requires read access. Which access control principle has been violated?

Which access control model uses subject and object labels to enforce access based on a security policy?

A company implements a policy where a financial transaction must be initiated by one employee and approved by a different employee. This is an example of which access control concept?

An organization uses Active Directory and wants to grant a group of temporary interns access to a shared folder for exactly 30 days. Which access control approach is most efficient?

Which TWO are characteristics of Role-Based Access Control (RBAC)?

Which THREE are valid methods for authenticating a user in an access control system?

You are the security administrator for a mid-sized e-commerce company. The company uses a Linux-based web server running Apache, with a MySQL database backend. User authentication is handled via LDAP. Recently, the security team discovered that a former employee's account was used to access the customer database two weeks after the employee was terminated. The account had not been disabled. The database contains personally identifiable information (PII). The incident was traced to an internal IP address from the marketing department. The marketing department's network segment is not segregated from the database server. Additionally, the database server's firewall rules allow any internal IP to connect to the MySQL port (3306). The company has a written policy that accounts must be disabled within 24 hours of termination, but the HR department did not notify IT in a timely manner. Which combination of controls would BEST prevent a recurrence of this incident?

A company is implementing an access control system to protect sensitive data. Employees in the finance department must access financial records, but only during business hours and from company-issued devices. Which access control model best supports these requirements?

A security administrator is reviewing the principles of access control. Which TWO of the following are core components of the AAA framework? (Select TWO.)

Refer to the exhibit. A security analyst notices that a user with the Finance role is able to write to /finance/data from a macOS device at 10:00 AM. The policy shown is the only policy affecting this resource. What is the most likely reason for this behavior?

Drag and drop the steps to configure a static route on a Cisco IOS router into the correct order.

Drag and drop the steps to implement a firewall rule allowing inbound HTTPS traffic into the correct order.

Match each security control type to its description.

Match each authentication factor to an example.

A system administrator needs to grant a user the ability to read files in a specific folder but not modify them. Which access control principle should be applied?

A financial company requires that any transaction over $10,000 must be approved by two different managers before being processed. This is an example of which access control principle?

During a security audit, it is discovered that a contractor has access to customer databases that were not required for their project. Which step should be taken first to mitigate the risk?

An organization implements an access control system where users are assigned to groups, and permissions are granted to groups rather than individuals. This is known as:

A user reports that they are unable to access a shared network drive that they previously could access. The administrator checks permissions and finds the user's account is still a member of the correct group. What should the administrator check next?

In a defense-in-depth strategy, which access control mechanism provides the most granular control over user permissions?

Which access control model allows the owner of a resource to decide who can access it?

A system administrator notices that a user has been granted read and write permissions to a folder but should only have read access. Which type of access control issue does this represent?

When implementing a role-based access control (RBAC) system, what is the primary challenge organizations face?

An organization is implementing a new access control system based on the principle of least privilege. Which two of the following practices are essential to achieving least privilege? (Select TWO)

A security analyst is troubleshooting an access control issue where a user cannot access a file even though they seem to have the correct permissions. Which three of the following should the analyst investigate? (Select THREE)

Which two of the following are examples of physical access controls? (Select TWO)

Refer to the exhibit. The file is readable and writable by everyone. A user from the marketing team, user2, needs to be able to read the file but not write to it. Which command should the administrator use to achieve this?

Refer to the exhibit. A user from the Auditors group is unable to access the folder. What is the most likely cause?

Refer to the exhibit. A user with this policy tries to list objects in bucket1 but gets an access denied error. What is the most likely reason?

A company needs to enforce access based on attributes such as time of day and location. Which access control model is most appropriate?

An organization wants to ensure that no single employee can both request and approve a payment. Which access control principle does this enforce?

In a MAC environment implementing Bell-LaPadula, a subject with Secret clearance attempts to read an object classified as Confidential and write to an object classified as Top Secret. Which operations are permitted?

Which authentication factor does a smart card represent?

After a reorganization, a company using RBAC finds that many users have accumulated permissions that no longer align with their job functions. What is the best practice to address this?

In a Bell-LaPadula MAC model, which of the following operations is prohibited?

What is the primary purpose of identification in the context of access control?

Which component of the AAA framework determines what resources an authenticated user can access?

In a typical Windows environment, which access control model is used for managing file permissions?

Based on the exhibit, which statement about the access control list is true?

An IAM policy is shown in the exhibit. Which action is permitted for the attached user?

The exhibit shows recent authentication logs. What type of attack is most likely indicated?

Which TWO of the following are examples of physical access controls?

Which TWO scenarios best illustrate the principle of least privilege?

Which THREE components are part of the AAA framework?

A help desk technician needs to reset a user's password, but the security policy requires that the technician does not know the new password. Which access control concept prevents the technician from knowing the password?

An organization implements a policy where users must swipe their ID card and enter a PIN to access a secure room. This is an example of which access control principle?

After a security audit, a company discovers that several employees have access to financial systems that are not required for their job roles. Which access control model would best prevent this issue in the future?

A system administrator needs to grant a contractor temporary access to a server for patching. The contractor should only have access during the patching window. Which access control implementation method is most appropriate?

A company uses a mandatory access control (MAC) system where all files are labeled 'Confidential', 'Secret', or 'Top Secret'. A user with 'Secret' clearance tries to read a 'Top Secret' file. What is the outcome?

An organization wants to implement a system that enforces access decisions based on a user's attributes (e.g., department, clearance, time) and environmental conditions. Which model is best?

Which TWO are examples of technical access controls?

Which TWO are principles of access control?

Which THREE are examples of administrative access controls?

A financial firm has a data center with strict access controls. Employees must use smart cards and PINs to enter a mantrapped entrance. Recently, an unauthorized person gained access by following an employee through the mantrapped door (tailgating). The security team reviews logs and finds that the door was opened twice in quick succession, indicating tailgating occurred. The firm wants to implement a solution that prevents tailgating without slowing down authorized access. Which action should they take?

A hospital uses role-based access control (RBAC) for its electronic health records. Nurses can view patient records; doctors can view and edit; administrators can only view administrative data. Recently, a nurse was able to edit a patient's record, which should only be allowed for doctors. The investigation finds that the nurse's role was incorrectly assigned a 'doctor' role due to a misconfiguration. To prevent recurrence, the access control system should be reviewed. Which is the best long-term solution?

A small business uses a cloud file storage service that allows sharing links. An employee mistakenly shared a folder containing customer data via a public link. The business wants to prevent such incidents in the future without blocking legitimate sharing. Which access control method should they implement?

A government agency uses a multi-level security system with mandatory access control (MAC). A user with Secret clearance attempts to write data to a file classified as Confidential. Under the Bell-LaPadula model, which rule applies and what is the outcome?