Chapter 14 – Controlling and Monitoring Access

Question 1

1. Which of the following best describes an implicit deny principle?
   All actions that are expressly allowed are denied.

Answer 1

All actions that are expressly allowed are denied.

Question 2

2. What is the intent of least privilege?

Enforce the most restrictive rights required by users to complete assigned tasks.

Answer 2

Enforce the most restrictive rights required by users to complete assigned tasks.

Question 3

3. A table includes multiple objects and subjects and it identifies the specific access each subject has to different objects. What is this table?
   Access control matrix

Answer 3

Access control matrix

Question 4

4. What type of access controls are hardware or software mechanisms used to manage access to resources and systems, and provide protection for those resources and systems?
   The data custodian

Answer 4

The data custodian

Question 5

5. Which of the following models is also known as an identity-based access control model?
   DAC

Answer 5

DAC

Question 6

6. A central authority determines which files a user can access. Which of the following best describes this?
   Nondiscretionary access control model

Answer 6

Nondiscretionary access control model

Question 7

7. A central authority determines which files a user can access based on the organization’s hierarchy. Which of the following best describes this?
   RBAC model

Answer 7

RBAC model

Question 8

8. Which of the following statements is true related to the RBAC model?
   A RBAC model allows users membership in multiple groups.

Answer 8

A RBAC model allows users membership in multiple groups.

Question 9

9. Which of the following is the best choice for a role within an organization using a RBAC model?
   Programmer.

Answer 9

Programmer.

Question 10

10. Which of the following best describes a rule-based access control model?
    It uses global rules applied to all users equally.

Answer 10

It uses global rules applied to all users equally.