CAP Authorization & Access Control 3 — Questions and Answers
Question 1: Which access control mechanism allows the owner of a resource to grant access to other users at their own discretion?
- Mandatory Access Control (MAC)
- Role-Based Access Control (RBAC)
- Discretionary Access Control (DAC) (Correct answer)
- Rule-Based Access Control
Correct answer: Discretionary Access Control (DAC)
In DAC, the resource owner has discretion to grant or revoke access to other subjects, such as file owners setting permissions in traditional OS environments.
Question 2: A policy requiring users to log in with separate accounts for administrative versus regular tasks best implements which principle?
- Account aggregation
- Dual control
- Least privilege (Correct answer)
- Need to know
Correct answer: Least privilege
Using separate accounts for privileged and regular work limits the exposure of elevated privileges by applying least privilege to each session.
Question 3: In the Bell-LaPadula model, the '*-property' (star property) rule states that a subject:
- Cannot read data at a higher classification level
- Cannot write data to a lower classification level (Correct answer)
- Can read and write only at its own level
- Must authenticate before any access is granted
Correct answer: Cannot write data to a lower classification level
The *-property prevents write-down, ensuring classified information cannot flow to lower classification levels where it shouldn't be accessible.
Question 4: Which of the following is a key difference between authentication and authorization?
- Authentication determines what a user can do; authorization verifies who they are
- Authentication verifies identity; authorization determines what actions are permitted (Correct answer)
- Both are synonymous terms for access control
- Authorization occurs before authentication in secure systems
Correct answer: Authentication verifies identity; authorization determines what actions are permitted
Authentication establishes identity (who you are), while authorization determines what that authenticated identity is allowed to do.
Question 5: An access control matrix row represents a subject's permissions. What does each column represent?
- A user's role assignment
- Permissions for a specific object or resource (Correct answer)
- An audit log entry
- A network segment boundary
Correct answer: Permissions for a specific object or resource
In an access control matrix, columns represent objects (resources), and each cell specifies the access rights a subject has to that object.
Question 6: Which access control concept is most directly implemented by a firewall's rule set that permits or denies traffic based on IP and port?
- Discretionary Access Control
- Rule-Based Access Control (Correct answer)
- Attribute-Based Access Control
- History-Based Access Control
Correct answer: Rule-Based Access Control
Rule-Based Access Control uses predefined rules (such as firewall ACLs) to permit or deny access based on conditions like source IP, destination port, and protocol.
Question 7: In a CAP context, which document formally establishes the boundary of an authorization decision for an information system?
- System Security Plan (SSP)
- Authorization Boundary document (Correct answer)
- Privacy Impact Assessment (PIA)
- Plan of Action and Milestones (POA&M)
Correct answer: Authorization Boundary document
The authorization boundary defines the scope of the information system for which the Authorizing Official (AO) grants an Authority to Operate (ATO).
CAP Authorization & Access Control 3
Which access control mechanism allows the owner of a resource to grant access to other users at their own discretion?