Access Controls

Question 1 of 6

A government agency operates a classified system where data is labeled Confidential, Secret, or Top Secret. Users are assigned clearance levels that match or exceed the data they can access. The system administrator assigns all labels, and users cannot modify any label even on files they created. Which access control model is in use?

Discretionary Access Control (DAC) — the file creator assigns labels as they see fit Role-Based Access Control (RBAC) — users are assigned to roles (Confidential, Secret, Top Secret) that determine their access Mandatory Access Control (MAC) — the OS enforces access based on system-assigned classification labels; users cannot modify labels regardless of file ownership Attribute-Based Access Control (ABAC) — multiple attributes including classification, time, and location are evaluated for every access request

Question 2 of 6

An employee creates a shared folder on their workstation and adds specific colleagues to the folder's permission list. Later, they share the folder with a third colleague without asking IT or management. Which access control model is this, and what is its primary weakness?

Mandatory Access Control — the weakness is that the OS can be bypassed by file owners with sufficient technical knowledge Discretionary Access Control (DAC) — the weakness is that security depends entirely on each resource owner making correct access decisions; owners may inadvertently or intentionally share sensitive data with unauthorized parties Role-Based Access Control — the weakness is that roles are too broad and cannot be customized for individual users Rule-Based Access Control — the weakness is that the system rules cannot account for the specific context of each sharing decision

Question 3 of 6

A new employee joins the Sales department. The IT administrator adds them to the “Sales Representatives” Active Directory security group. The employee immediately gains access to the CRM system, the sales analytics dashboard, and the customer database without any additional individual permission grants. What access control model explains this behavior?

Discretionary Access Control — the employee's manager granted access using their ownership rights over department resources Mandatory Access Control — the employee was assigned the Secret clearance level which grants access to Sales resources by label comparison Role-Based Access Control (RBAC) — group membership implicitly grants all access rights assigned to the Sales Representatives role without requiring individual permission grants for each resource Rule-Based Access Control — a system rule automatically detects when a user is created and grants CRM access based on their department attribute

Question 4 of 6

A financial company's access policy states: “Allow access to the trading platform only from IP addresses in the 172.16.0.0/16 range, only on weekdays, and only between 7 AM and 8 PM.” This policy is enforced by the system automatically for every access attempt. Which access control model does this represent?

Role-Based Access Control — users must be members of the “Trading Hours” security group to access the platform during allowed times Rule-Based Access Control — system-enforced conditions (IP range, day of week, time of day) are evaluated automatically for every access attempt against the ACL Mandatory Access Control — the trading platform has a classification label that restricts access to users with the correct clearance and time credentials Discretionary Access Control — the trading platform owner configured these time and IP restrictions based on their own access management decisions

Question 5 of 6

A healthcare organization implements an access control system where a doctor's access to patient records depends on: (1) their role (physician, not admin staff), (2) whether the patient is assigned to them, (3) the time of day (no access between midnight and 6 AM), (4) the network they are connecting from (hospital VPN required), and (5) whether they are performing a read or write operation. Access decisions change based on any of these factors changing. Which access control model is this?

Role-Based Access Control — the physician role grants access to patient records with time restrictions added as a secondary rule Rule-Based Access Control — multiple conditions in ACLs are evaluated simultaneously for each access attempt Attribute-Based Access Control (ABAC) — multiple attributes from the subject (role, patient assignment), environment (time, network), and action (read vs. write) are all evaluated simultaneously to make each context-aware access decision Mandatory Access Control — patient records are classified at a level that only physicians with the correct clearance can access

Question 6 of 6

A call center employee who works 9 AM to 5 PM has their account configured so that login attempts outside those hours are rejected, even if the correct password is provided. An attacker who steals the employee's password attempts to log in at 2 AM and is denied. What access control mechanism blocked the attacker?

Mandatory Access Control — the system detected that the clearance level of the login request at 2 AM did not match the classification label of the employee's account Multi-factor authentication — the attacker did not have the second factor required for after-hours authentication Time-of-day restriction — a rule-based control that limits when an account can authenticate, rejecting valid credentials when the access attempt falls outside the authorized time window User Behavior Analytics — the anomalous login time triggered an automatic account lockout based on the employee's behavioral baseline

Matching

Match each description to the correct access control model.

1. Access control where the operating system enforces access based on security classification labels assigned by an administrator; users cannot modify labels even on files they own

2. Access control where the resource owner determines who can access their resources; default model in most commercial operating systems; security depends on owner decisions

3. Access control where users receive access rights by being assigned to roles or groups; access is implicit through group membership rather than individually granted

4. Access control where multiple simultaneous attributes from the subject, object, environment, and action are evaluated to make dynamic, context-aware access decisions

1. 2. 3. 4.

A. MAC (Mandatory Access Control)

B. DAC (Discretionary Access Control)

C. RBAC (Role-Based Access Control)

D. ABAC (Attribute-Based Access Control)

Access Controls — Quiz

Matching