CIAM Access Control Models 3 — Questions and Answers
Question 1: In RBAC, what term describes the assignment of a role to a user that allows the user to exercise the role's permissions?
- Permission assignment
- Role activation
- User-Role Assignment (URA) (Correct answer)
- Delegation
Correct answer: User-Role Assignment (URA)
User-Role Assignment (URA) is the relationship in RBAC that maps users to roles, granting them all permissions associated with those roles.
Question 2: Which RBAC constraint ensures that a user cannot hold two conflicting roles, such as both 'payment initiator' and 'payment approver'?
- Role hierarchy
- Cardinality constraint
- Static Separation of Duty (SSD) (Correct answer)
- Dynamic Separation of Duty (DSD)
Correct answer: Static Separation of Duty (SSD)
Static SSD prevents users from being assigned to mutually exclusive roles simultaneously in their user-role assignment, enforcing segregation of duties.
Question 3: What distinguishes Dynamic Separation of Duty (DSD) from Static Separation of Duty (SSD) in RBAC?
- DSD applies constraints at role assignment; SSD applies at session activation
- DSD applies constraints at session activation; SSD applies at role assignment (Correct answer)
- DSD uses labels while SSD uses permissions
- DSD is enforced by the OS while SSD is enforced by the application
Correct answer: DSD applies constraints at session activation; SSD applies at role assignment
DSD allows a user to hold conflicting roles but prevents activating them simultaneously in the same session, while SSD prevents conflicting role assignments entirely.
Question 4: A healthcare system grants doctors read access to all patient records but write access only to their own patients' records. This scenario best illustrates which model?
- Pure MAC
- RBAC with object-level constraints
- ABAC (Correct answer)
- Chinese Wall Model
Correct answer: ABAC
ABAC can combine role attributes (doctor) with relationship attributes (my patient) and action attributes (read vs. write) to enforce this nuanced policy.
Question 5: The Chinese Wall Model is primarily designed to prevent:
- Unauthorized data deletion
- Conflicts of interest between competing organizations (Correct answer)
- Privilege escalation attacks
- Insider threats from disgruntled employees
Correct answer: Conflicts of interest between competing organizations
The Chinese Wall (Brewer-Nash) Model prevents consultants from accessing data from competing companies by dynamically restricting access based on prior accesses.
Question 6: In MAC systems, sensitivity labels typically consist of which two components?
- Username and timestamp
- Classification level and categories (compartments) (Correct answer)
- Role name and permission set
- Resource type and access type
Correct answer: Classification level and categories (compartments)
MAC labels combine a hierarchical classification (e.g., Top Secret) with non-hierarchical categories or compartments (e.g., NUCLEAR, NATO) for fine-grained control.
Question 7: Which access control model is considered the most flexible but also the most administratively complex due to policy rule management?
- DAC
- MAC
- RBAC
- ABAC (Correct answer)
Correct answer: ABAC
ABAC offers the most flexibility by combining unlimited attributes into policies, but this creates significant complexity in authoring, maintaining, and debugging policies.
CIAM Access Control Models 3
In RBAC, what term describes the assignment of a role to a user that allows the user to exercise the role's permissions?