Access Control Independent Practice

What is an access control system?

• A set of technical controls that govern how subjects may interact with objects.

• A system that manages network traffic.

• A software that monitors user activity.

• A hardware device that stores data.

Answer explanation

An access control system is a set of technical controls that govern how subjects may interact with objects, making it the correct choice.

Which of the following is NOT one of the four main processes of an access control system?

• Identification

• Authentication

• Authorization

• Encryption

Answer explanation

Encryption is NOT one of the four main processes of an access control system. The main processes are Identification, Authentication, and Authorization.

What does the principle of least privilege mean?

Answer explanation

The principle of least privilege means giving users only the minimum level of access or permissions needed to perform their tasks, reducing the risk of unauthorized access or misuse.

What is the principle of implicit deny?

Answer explanation

The principle of implicit deny states that unless a rule explicitly allows traffic, it is denied by default.

In the context of access control, what is an Access Control List (ACL)?

Answer explanation

An Access Control List (ACL) is a list of permissions attached to an object that specifies which users or system processes are granted access to objects, as well as what operations are allowed on given objects.

Which access control model stresses the importance of the owner and grants them full control over the resource?

• Discretionary Access Control (DAC)

• Role-based Access Control (RBAC)

• Mandatory Access Control (MAC)

• Rule-based Access Control

Answer explanation

Discretionary Access Control (DAC) stresses the importance of the owner and grants them full control over the resource, making it the correct choice.

Which access control model adds an extra degree of administrative control to the DAC model by defining organizational roles?

• Discretionary Access Control (DAC)

• Role-based Access Control (RBAC)

• Mandatory Access Control (MAC)

• Rule-based Access Control

Answer explanation

Role-based Access Control (RBAC) adds an extra degree of administrative control by defining organizational roles.

Which access control model is based on the idea of security clearance levels and uses a hierarchical structure?

• Discretionary Access Control (DAC)

• Role-based Access Control (RBAC)

• Mandatory Access Control (MAC)

• Rule-based Access Control

Answer explanation

The access control model based on security clearance levels and a hierarchical structure is Mandatory Access Control (MAC). It enforces restrictions based on security labels assigned to resources and users.

Which access control model can refer to any sort of access control policies determined by system-enforced rules rather than system users?

• Discretionary Access Control (DAC)

• Role-based Access Control (RBAC)

• Mandatory Access Control (MAC)

• Rule-based Access Control

Answer explanation

Rule-based Access Control refers to access control policies determined by system-enforced rules rather than system users.

What is the primary purpose of the accounting part of the access control system?

• To provide a log of user activities and access privileges

• To prevent unauthorized access to the network

• To encrypt user data

• To manage user passwords

Answer explanation

The primary purpose of the accounting part of the access control system is to provide a log of user activities and access privileges, allowing for monitoring and auditing of system usage.