CAP Authorization & Access Control 2 — Questions and Answers
Question 1: Which access control model assigns permissions based on user attributes, resource attributes, and environmental conditions?
- Role-Based Access Control (RBAC)
- Attribute-Based Access Control (ABAC) (Correct answer)
- Discretionary Access Control (DAC)
- Mandatory Access Control (MAC)
Correct answer: Attribute-Based Access Control (ABAC)
ABAC evaluates multiple attributes simultaneously — including subject, object, and environment attributes — to make fine-grained authorization decisions.
Question 2: Under the principle of least privilege, a system administrator who performs daily backups should have which of the following?
- Full administrative rights to all systems
- Only the rights needed to perform backup operations (Correct answer)
- Read access to all files and write access to backup storage
- Superuser credentials shared with the security team
Correct answer: Only the rights needed to perform backup operations
Least privilege requires granting only the minimum access necessary for a user to perform their specific job functions.
Question 3: A security label of 'SECRET//NOFORN' in a MAC system indicates that the data is classified SECRET and:
- Cannot be released to foreign nationals (Correct answer)
- Must be encrypted at rest
- Requires two-person integrity for access
- Is restricted to law enforcement only
Correct answer: Cannot be released to foreign nationals
NOFORN is a handling caveat meaning the information is not releasable to foreign nationals or foreign governments.
Question 4: Which authorization concept ensures that no single individual can complete a sensitive transaction alone?
- Separation of duties (Correct answer)
- Least privilege
- Need to know
- Account aggregation
Correct answer: Separation of duties
Separation of duties divides critical tasks among multiple people to prevent fraud and error by requiring collusion to circumvent controls.
Question 5: In RBAC, which component maps users to collections of permissions?
- Access control list (ACL)
- Role (Correct answer)
- Security label
- Capability table
Correct answer: Role
In RBAC, roles are defined sets of permissions that are then assigned to users, centralizing permission management.
Question 6: An organization implements a policy that prevents a user who approves purchase orders from also creating them. This is an example of:
- Mandatory access control
- Separation of duties (Correct answer)
- Dynamic access control
- Role explosion
Correct answer: Separation of duties
Separation of duties requires that conflicting roles — such as creator and approver — be assigned to different individuals.
Question 7: Which of the following best describes 'role explosion' in an RBAC implementation?
- Users gaining unauthorized elevated privileges at runtime
- An unmanageable proliferation of overly specific roles (Correct answer)
- Roles being automatically inherited through hierarchy
- A denial-of-service attack targeting access control systems
Correct answer: An unmanageable proliferation of overly specific roles
Role explosion occurs when organizations create too many granular roles to accommodate exceptions, making the RBAC system difficult to manage.
CAP Authorization & Access Control 2
Which access control model assigns permissions based on user attributes, resource attributes, and environmental conditions?