CAP Authorization & Access Control 5

Question 1

Which of the following is the PRIMARY purpose of an access control list (ACL) on a file system?

Accepted Answer

Specifying which users or groups can perform specific operations on a resource

Answer

An ACL is a list of permissions attached to a resource that specifies which subjects can perform which operations (read, write, execute) on it.

Question 2

The Biba integrity model's 'simple integrity property' prohibits a subject from:

Accepted Answer

Reading data from a lower integrity level

Answer

Biba's simple integrity property (no read-down) prevents subjects from reading lower-integrity data to protect the integrity of higher-integrity processes.

Question 3

Which authorization concept is violated when a developer has both write access to production code AND the ability to deploy it to production without review?

Accepted Answer

Separation of duties

Answer

Allowing one person to both write and deploy code removes the check-and-balance that separation of duties is designed to provide.

Question 4

In a zero trust architecture, what is the default access posture for any user or device attempting to connect to a resource?

Accepted Answer

Denied until explicitly verified and authorized

Answer

Zero trust assumes no implicit trust — every access request must be explicitly verified and authorized regardless of network location.

Question 5

Which NIST RMF step involves granting an Authority to Operate (ATO) after reviewing residual risk?

Accepted Answer

Authorize

Answer

The Authorize step is where the Authorizing Official (AO) reviews the security assessment package and decides whether to grant, deny, or conditionally grant an ATO.

(CAP) Certified Authorization Professional Practice Test

(CAP) Certified Authorization Professional Practice Test

CAP Authorization & Access Control 5