Week 7 Flashcards
Role & Access Based access control models
__________ controls access of a user to information through their role or job.
Role-based access control (RBAC)
What are the 3 primary entities in RBAC?
users
roles
permissions
In RBAC, _____ are assigned to ____ which are assigned permissions.
users
roles
In RBAC, roles are assigned in a ______ for role inheritance.
hierarchy
______ eliminates the need to assign permissions directly to users.
RBAC
What are the disadvantages in RBAC?
Users may have more permissions than needed.
Users may not have the ability to do one-time operations.
Roles assignment may not be properly changed.
In _________ the access rights are based on the values associated with the subject, object and environment.
Attribute-based access control (ABAC)
______ are characteristics associated with an entity.
A. Identity
B. Associations
C. Attributes
D. Objects
C. Attributes
In ABAC the permissions are _____ and they have to be computed.
dynamic
ABAC uses a neutral XML-based language called _______.
A. NXML
B. XACML
C. ABXML
D. None of the above
B. XACML
A ______ is the topmost level of the XACML language and consists of one or more _____ elements.
PolicySet
Policy
in ABAC a policy contains one or more _______.
A. Rules
B. Attributes
C. Subjects
D. Objects
A. Rules
A _____ defines the scope for the PolicySet. It defines the set of resources for which the PolicySet applies.
Target
The ____ contains a target and a set of one or more rules.
Policy
A _____ contains a target and an effect and condition component.
Rule
A PolicySet contains 3 components. What are they?
Policy
Target
Rules
In the XACML data flow, the _______ is the core of the access decision engine as it performs key operations, including evaluating policies and encoding the access decision response.
Policy Decision Point (PDP)
In XACML, the ______ writes policies and policy sets to make them available to the Policy Decision Point.
Policy Administration Point (PAP)
In XACML, access requests are sent to the ______.
A. Policy Administration Point
B. Policy Enforcement Point
C. Policy Information Point
D. Policy Decision Point
B. Policy Enforcement Point (PEP)
The ____ evaluates applicable policies and returns the authorization decision to the ______, which sends to the _____ for enforcement of the decision.
PDP
Context Handler
PEP
