Identity and Access Control Quiz

What is the process of limiting users to access only the functionality and data that they are specifically permitted to use?

• Validation

• Access Control

• Authorization

• Authentication

Which component defines the user or entity making the request in the access control system?

• Group

• Subject

• Object

• Role

What is the most common attack on access control where an attacker manipulates input to access unauthorized features or data?

• Malware

• Phishing

• Privilege Escalation

• Data Breach

Which access control anti-pattern relies on protecting parts of the system based on obscure URLs and patterns?

• Fail open

• Adding access control manually

• Hard coded policy

• Relying on obscurity

What is the key design flaw of hard coding authorization policies into application code?

• Merging application code and policy

• Ease of maintenance

• Scalability

• Flexibility

Which guiding principle suggests building a centralized access control engine/decision maker?

• Consider a centralized enforcement layer

• Group subjects, objects, actions, and metadata

• Build a centralized access control engine

• Server-side trusted data should access control decisions

What is the main limitation of Role-Based Access Control (RBAC) compared to Attribute-Based Access Control (ABAC)?

• Adoption

• Maintenance

• Functionality

• Ease of implementation

Which access control mechanism is highly flexible, allowing decisions based on attributes of users, objects, and environmental conditions?

• RBAC

• MAC

• ABAC

• Access Control Lists

What is the purpose of a Policy Enforcement Point (PEP) in the access control system?

• Create new policies

• Handle access control checks

• Apply policies to subjects and groups

• Make access control decisions

Which component of access control describes any attribute source potentially needed to make an access decision?

• Policy Decision Point (PDP)

• Policy Information Point (PIP)

• Policy Administration Point (PAP)

• Policy Enforcement Point (PEP)