CIAM Access Control Models 4

Question 1

Which access control model would be MOST appropriate for a government system that must enforce strict information classification and cannot allow users to override access decisions?

Accepted Answer

Mandatory Access Control

Answer

MAC is mandated by the system, not individual owners, making it ideal for environments where classification policy must be enforced uniformly and cannot be overridden.

Question 2

A Zero Trust Architecture primarily challenges which traditional access control assumption?

Accepted Answer

Resources inside the network perimeter are trusted by default

Answer

Zero Trust eliminates implicit trust for internal network traffic, requiring explicit verification of every access request regardless of network location.

Question 3

In XACML (eXtensible Access Control Markup Language), what component makes the actual access decision?

Accepted Answer

Policy Decision Point (PDP)

Answer

The PDP evaluates applicable policies against the access request and returns Permit, Deny, NotApplicable, or Indeterminate decisions.

Question 4

Role explosion is a common problem in RBAC implementations. Which approach best mitigates this issue?

Accepted Answer

Introducing role hierarchies and parameterized roles

Answer

Role hierarchies allow permission inheritance and reduce redundancy, while parameterized roles use context variables to handle variations without creating new roles.

Question 5

Which access control implementation correctly prevents the 'confused deputy problem'?

Accepted Answer

Using capability tokens tied to the requesting principal's identity

Answer

Capability tokens bound to the requesting principal's identity ensure that a privileged service acts on behalf of the caller's permissions, not its own elevated permissions.

(CIAM) Certified Identity and Access Manager Practice Test

(CIAM) Certified Identity and Access Manager Practice Test

CIAM Access Control Models 4