Access Control Principles Quiz

What is the principle of Least Privilege in access control?

• Individuals or systems are granted only those access rights or permissions essential to perform their intended functions.

• Individuals should have access only to the information and resources absolutely necessary for their specific tasks.

• Responsibilities and privileges are divided among multiple people to prevent fraud.

• A layered approach to security that relies on multiple barriers.

What does the Need-to-Know principle stipulate?

• Individuals should have access only to the information and resources absolutely necessary for their specific tasks.

• Access rights should be granted based on the least privilege.

• Responsibilities should be divided among multiple people.

• Access control should be layered.

What is Separation of Duties (SoD)?

• Dividing responsibilities and privileges among multiple people to prevent fraud and errors.

• Granting users the minimum level of access necessary to perform their tasks.

• A list of permissions associated with a resource.

• A record of events related to access control.

What is Defense-in-Depth?

• A layered approach to security that relies on multiple barriers.

• The process of verifying the identity of a user.

• The principle of granting users the minimum level of access.

• A record of events related to access control.

Why is access control essential?

• To protect confidentiality, integrity, and availability of systems.

• To ensure that sensitive information is accessible only to authorized individuals.

• To prevent unauthorized modification of data.

• All of the above.

What does the principle of least privilege state?

• Users should be granted only the minimum level of access necessary to perform their job functions.

• Access should be granted based on the need-to-know principle.

• Access rights should be divided among multiple people.

• Access control should be layered.

What is the purpose of an Access Control List (ACL)?

• To specify which users or groups have access to a resource and the type of access they are granted.

• To track access attempts and resource usage.

• To verify the identity of a user.

• To represent the permissions each subject has to each object.

What is the definition of identification in access control?

What is the process of verifying a provided identity called?

What the user knows indicates that we authenticate based on some information that only the user has knowledge of. What are the problems associated with passwords?

• Passwords can be insecure

• Passwords are easily broken

• Passwords are inconvenient

• Passwords are reputable