Skip to content
AvailabilitySign inBook a DemoStart free lab
Topic: Access Control Models & FederationSwitch
All CISSP topics

5.0 Identity and Access Management

Access Control Models & Federation Practice Questions

DAC, MAC, RBAC and ABAC, Kerberos, RADIUS vs. TACACS+, SSO, SAML, and OAuth vs. OpenID Connect.

One solved question, so you can see how these are marked

A research organization must prevent users from changing the classification of documents, even when a user owns a document. Which access control model BEST supports this requirement?

Mandatory access control, because system-enforced labels govern subjects and objects

Mandatory access control uses centrally enforced labels and classifications, so an owner cannot override policy. DAC gives owners discretion, RBAC grants permissions through roles, and generic rule-based control does not inherently provide the label lattice required here.

Every question in the set below is marked like this. The answers stay hidden until you pick one.

All 9 Access Control Models & Federation questions in this set

Answers and explanations appear when you work through the set above.

  1. An enterprise wants access decisions to consider a user's department, the requested resource's sensitivity, device health, location, and time of day. Which approach is MOST appropriate?

    • Attribute-based access control
    • Discretionary access control
    • Role-based access control only
    • Mandatory access control using one classification label

  2. A security manager is reducing administrative overhead for a large organization. Permissions should follow job responsibilities, and removing a worker from a job function should remove the associated access. Which model should the manager prioritize?

    • Rule-based access control
    • Attribute-based access control
    • Role-based access control
    • Discretionary access control

  3. A user has authenticated to a Kerberos realm and needs access to a file service. Which sequence BEST describes the normal ticket flow?

    • The client sends a service ticket to the AS, then receives a TGT from the application server
    • The client obtains a TGT from the AS, exchanges it at the TGS, then sends the service ticket and authenticator to the service
    • The service creates a TGT for the client, which returns it to the AS to obtain a service ticket and authenticate to the file server
    • The client sends its password to the TGS, which forwards it to the service for validation

  4. A company is selecting AAA protocols for network device administration. It needs reliable transport and detailed per-command authorization, while its remote access gateways need a widely supported network access protocol. Which recommendation is BEST?

    • Use RADIUS for device administration and TACACS+ for wireless access because TACACS+ uses UDP
    • Use Diameter for every device because it is the original protocol for dial-up access
    • Use TACACS+ for device administration and RADIUS for network access
    • Use Kerberos for both because it provides the same AAA message model as RADIUS

  5. A business wants employees to sign in once at a corporate identity provider and then access several partner web applications without separate application passwords. What capability should the architect implement?

    • Single sign-on using federation and trusted assertions
    • Local authorization lists copied independently to each application
    • OAuth access tokens without an identity or authentication protocol
    • A shared administrator account across all partner applications

  6. A web service must let a partner application call selected APIs on a user's behalf, but the service does not need the protocol to assert who authenticated the user. Which technology is the BEST fit?

    • SAML, because XML assertions are required for every API call
    • OpenID Connect, because it replaces authorization scopes with an ID token
    • Kerberos, because service tickets are designed for internet-wide delegation
    • OAuth 2.0, which delegates resource access through scopes and access tokens

  7. An application needs both delegated API access and a verifiable statement about the authenticated user's identity. Which option should the security architect choose?

    • OpenID Connect on top of OAuth 2.0
    • RADIUS with an Access-Accept message
    • SAML without a service provider
    • A bare OAuth 2.0 access token interpreted as proof of authentication

  8. A privileged administrator needs emergency production access for 30 minutes. Which control BEST reduces standing privilege while preserving accountability?

    • Give the administrator a permanent global account and log its use during the incident
    • Allow the administrator to share the database owner's password during the incident
    • Use approved just-in-time PAM access with least privilege, expiration, and session logging
    • Disable privileged access reviews because the emergency is time sensitive

  9. A healthcare organization wants a policy that allows nurses to view patient records only when assigned to the patient's ward, using a managed device during an active shift. Which design BEST reflects the difference between role and rule-based controls?

    • Assign every nurse permanent ownership of every patient record
    • Use only a broad nurse role and omit contextual conditions
    • Use MAC labels alone, treating the nurse's current shift as a fixed classification of the patient record
    • Combine a nurse role with rules for ward assignment, device health, and shift time