2 Secure Design and Access Control Online Quiz Questions

True or false: If a user authenticates successfully, the user is automatically authorized to access every resource in the system.

A user has signed in, but the application must decide whether that user may change a billing setting. Which concept governs this decision?

An access decision depends on an employee's role, the record's sensitivity, and whether the employee is using an approved device. Which access-control model is being used?

True or false: In a zero-trust approach, being inside an organization's network perimeter is by itself enough to establish that a device is trustworthy.

A company gives support analysts permission to read support tickets but not change billing settings. It assigns these permissions through job roles. Which access-control model does this illustrate?

A team is reducing the risk that a compromised reporting application could be misused. Select all practices that apply least privilege to the application's access.

An authorization service is temporarily unavailable, so an application cannot determine whether a request is allowed. Which secure design principle says the application should deny the request rather than grant access by default?

A cloud application uses administrator authentication, fine-grained application authorization, restricted service-to-service network paths, protected secrets, and audit logs. Which design principle best describes combining these safeguards?

A team is reviewing its authorization controls for a cloud application. Select all practices that align with the recommended approach.

Explain the difference among identity, authentication, and authorization. Include why successful sign-in does not by itself give a user access to every resource.

For a sensitive system change, one employee approves the change and another implements it. Which practice does this illustrate?

A system checks a user's authorization at sign-in, then reuses that decision for every later request to protected resources. Does this meet the principle of complete mediation?

A service requests permission to read a database record. In access-control terminology, what is the requesting service called?

A support analyst signs in successfully but is denied permission to view payroll data. Which access-control concept determines whether the analyst may read that resource?

An application cannot contact its authorization service and therefore cannot determine whether a user may access a sensitive record. Which response best follows the fail-secure principle?

A cloud application generates reports from one dataset and does not need to change data or administer cloud resources. Which permission design best applies least privilege?

An employee may view a case record only if assigned to that case and using an approved device. Which access-control model most directly supports a decision based on both conditions?

An organization assigns permissions to job roles, then grants employees access through their assigned roles. What access-control model is this?