Identity and Access Control Quiz

What is the process of limiting users to access only the functionality and data that they are specifically permitted to use?

• Authentication

• Authorization

• Authentication

• Access Control

Which component defines the user or entity making the request in the access control system?

• Subject

• Group

• Object

• Role

What is the most common attack on access control where an attacker manipulates input to access unauthorized features or data?

• Data Breach

• SQL Injection

• Privilege Escalation

• Cross-Site Scripting

Which access control anti-pattern relies on protecting parts of the system based on obscure URLs and patterns?

• Using Request Data for Policy Decisions

• Relying on Obscurity

• Avoiding Access Control Features

• Hard Coded Policy

What is the key design flaw of hard coded authorization policies in an application?

• Difficulty in Auditing

• Ease of Adaptation

• Scalability

• Flexibility

Which guiding principle suggests building a centralized access control engine/decision maker?

• Server-Side Trusted Data

• Consider a Centralized Enforcement Layer

• Build a Centralized Engine

• Group Subjects and Objects

What is the main limitation of Role-Based Access Control (RBAC) compared to Attribute-Based Access Control (ABAC)?

• Data-Specific Control

• Context-Specific Control

• Real-Time Capabilities

• Complexity

Which access control mechanism is known for its flexibility in making decisions based on attributes of users, objects, and environmental conditions?

• MAC

• DAC

• ABAC

• RBAC

What is the purpose of a Policy Enforcement Point (PEP) in an access control system?

• Make Access Decisions

• Handle Rejected Decisions

• Handle Accepted Decisions

• Create New Policies

Which component of access control is responsible for describing any attribute source potentially needed to make an access decision?

• Policy Information Point (PIP)

• Policy Decision Point (PDP)

• Policy Administration Point (PAP)

• Policy Enforcement Point (PEP)