5 of 80 questions · Page 2/2 · Access Controls · Answers revealed
Which access control model allows the owner of a resource to determine who can access it and what privileges they have?
DAC enables owners to grant access to others.
Why this answer
DAC (Discretionary Access Control) lets the owner control access permissions. Other models have different control mechanisms.
A company is implementing an access control system for a high-security environment. Which TWO of the following are characteristics of Mandatory Access Control (MAC)?
MAC policies are centrally enforced.
Why this answer
MAC uses labels for subjects and objects, and access decisions are based on clearance and classification. Users cannot change permissions.
An organization implements a Privileged Access Management (PAM) solution. Which capability best describes granting temporary administrative rights just when needed?
JIT provisioning grants privileged access for a limited time and automatically revokes it.
Why this answer
Just-in-time (JIT) provisioning provides temporary elevated privileges that expire after use, reducing the attack surface.
A security architect is designing an access control system for a healthcare application that requires fine-grained access decisions based on user role, location, time of day, and patient consent. Which TWO access control models are best suited for this requirement?
RBAC can incorporate constraints like time and location via role activation conditions.
Why this answer
ABAC (Attribute-Based Access Control) is designed for fine-grained policies using multiple attributes. RBAC can also be extended with constraints (e.g., time-of-day, location) to achieve similar results, though ABAC is more flexible. MAC is too rigid, DAC is too coarse, and non-discretionary is a broad term.
Which federated identity protocol uses XML-based assertions and provides single sign-on across different security domains?
SAML is XML-based for federated SSO.
Why this answer
SAML uses XML assertions to exchange authentication and authorization data between an identity provider and a service provider.
Ready to test yourself?
Try a timed practice session using only Access Controls questions.