Access Control Policy Review for Security Engineers

1. Which access control framework is typically enforced by the operating system and cannot be overridden by users?

Discretionary Access Control

Mandatory Access Control

Role-Based Access Control

Attribute-Based Access Control

2. Which access control model is most scalable for large organizations with diverse job functions and dynamic role assignments?

Discretionary Access Control

Mandatory Access Control

Role-Based Access Control

User-based Access Control

Submit

4. Which of the following best describes the 'need-to-know' principle in access control policies?

Users should know all network passwords

Users should have access only to information required for their job

All employees should access the same resources

Managers should monitor all user activities

5. Biometric authentication (fingerprints, iris scans) relies on characteristics that cannot be easily duplicated or forgotten.

True

False

6. In group policy management, which principle ensures that administrative accounts have separate credentials from standard user accounts?

Account segregation

Credential rotation

Privileged account management

Multi-factor enforcement

Submit

8. Which protocol is commonly used for centralized authentication and authorization across network resources?

HTTPS

Kerberos

SSH

DNS

9. Single sign-on (SSO) allows users to authenticate once and access multiple systems without re-entering credentials.

True

False

10. A security engineer implements a policy where privileged accounts require approval from a manager before access is granted. What control type is this?

Detective control

Preventive control

Corrective control

Compensating control

11. Which access control model grants permissions based on a user's assigned job role or function within an organization?

Discretionary Access Control (DAC)

Role-Based Access Control (RBAC)

Attribute-Based Access Control (ABAC)

Rule-Based Access Control

12. In a zero trust security model, what is the default position for access requests?

Grant access unless explicitly denied

Deny access unless explicitly verified and authorized

Allow access only during business hours

Permit access to all internal network resources

13. Access control lists (ACLs) define which users or groups have permission to access a specific resource.

True

False

14. Which of the following is an example of a possession factor in authentication?

Fingerprint scan

Security token or smart card

Facial recognition

Security question answer

15. A security policy that allows resource owners to determine who has access to their files describes which access control model?

Mandatory Access Control (MAC)

Discretionary Access Control (DAC)

Role-Based Access Control (RBAC)

Attribute-Based Access Control (ABAC)

16. Which access control model uses attributes (user, resource, environment) to make dynamic access decisions?

RBAC

DAC

ABAC

MAC

17. In an access control policy, what does the principle of 'separation of duties' prevent?

Users from accessing resources they need

One person from having too much control over critical processes

Network administrators from monitoring traffic

Encryption of sensitive data

18. Multi-factor authentication (MFA) requires at least two different types of authentication factors to verify user identity.

True

False

19. Which authentication factor involves something the user knows, such as a password or PIN?

Biometric factor

Knowledge factor

Possession factor

Inherence factor

20. A network security policy requires that users have only the minimum permissions necessary to perform their job duties. What principle does this describe?

Defense in depth

Zero trust

Least privilege

Separation of duties

Network Security Engineer Reviewing an Access Control Policy Quiz

1. Which access control framework is typically enforced by the operating system and cannot be overridden by users?

2.

What first name or nickname would you like us to use?

2. Which access control model is most scalable for large organizations with diverse job functions and dynamic role assignments?

3. A security policy that requires periodic review and revocation of unnecessary user permissions demonstrates the practice of ____.

4. Which of the following best describes the 'need-to-know' principle in access control policies?

5. Biometric authentication (fingerprints, iris scans) relies on characteristics that cannot be easily duplicated or forgotten.

6. In group policy management, which principle ensures that administrative accounts have separate credentials from standard user accounts?

7. An access control policy defines what actions authenticated users are permitted to perform on resources. This describes ____.

8. Which protocol is commonly used for centralized authentication and authorization across network resources?

9. Single sign-on (SSO) allows users to authenticate once and access multiple systems without re-entering credentials.

10. A security engineer implements a policy where privileged accounts require approval from a manager before access is granted. What control type is this?

11. Which access control model grants permissions based on a user's assigned job role or function within an organization?

12. In a zero trust security model, what is the default position for access requests?

13. Access control lists (ACLs) define which users or groups have permission to access a specific resource.

14. Which of the following is an example of a possession factor in authentication?

15. A security policy that allows resource owners to determine who has access to their files describes which access control model?

16. Which access control model uses attributes (user, resource, environment) to make dynamic access decisions?

17. In an access control policy, what does the principle of 'separation of duties' prevent?

18. Multi-factor authentication (MFA) requires at least two different types of authentication factors to verify user identity.

19. Which authentication factor involves something the user knows, such as a password or PIN?

20. A network security policy requires that users have only the minimum permissions necessary to perform their job duties. What principle does this describe?