Question 360
A zero-trust gateway has a correct access policy but an application endpoint bypasses the gateway. Which response best addresses the central security requirement with a defensible, risk-based design?
- Update only the policy text without fixing bypass route
- Assume network ACLs evaluate user-level claims
- Ensure policy enforcement points cover every resource path and consult the decision authority
- Evaluate trusted subject, resource and context attributes in authorization policy
Explanation
Correct Answer
C:A correct PDP rule cannot protect traffic that avoids the PEP.
Incorrect Answers
A:Unmediated calls still succeed.
B:Layer-three rules cannot implement the entire policy.
D:ABAC scales fine-grained decisions when attributes are governed. Ensure policy enforcement points cover every resource path and consult the decision authority.
Question 361
After a prior rbac finding, a regional hospital network reports that the approved safeguard is implemented: “Map job functions to narrowly scoped roles with permissions separated by task.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Use the completion of this alternative as proof: Grant all medical staff one administrator role
- Accept a signed change ticket saying: Map job functions to narrowly scoped roles with permissions separated by task
- Run this adjacent but different test as the sole proof: Test normal versus anomalous contexts and observe differentiated decisions
- Compare effective permissions of roles to approved job functions
Explanation
Correct Answer
D:Role-level tests demonstrate least privilege.
Incorrect Answers
A:Shared broad authority defeats separation. Compare effective permissions of roles to approved job functions.
B:Compare effective permissions of roles to approved job functions. Role-level tests demonstrate least privilege.
C:Policy effectiveness requires context sensitivity. It tests risk-based access, while this case requires evidence about rbac.
Question 362
A cloud application grants access by department tags but lets users edit their own department attribute. Which response best addresses the central security requirement with a defensible, risk-based design?
- Protect attribute issuance and enforce trusted attribute sources before policy evaluation
- Allow users to self-assign a finance tag
- Switch all users to a common department value
- Map job functions to narrowly scoped roles with permissions separated by task
Explanation
Correct Answer
A:ABAC is only as trustworthy as the claims used for decisions.
Incorrect Answers
B:Untrusted attributes enable privilege escalation.
C:A common tag removes partitioning.
D:RBAC models operational duties, not unrestricted user attributes. Protect attribute issuance and enforce trusted attribute sources before policy evaluation.
Question 363
A classified document system enforces labels assigned by a central authority but resource owners ask to downgrade themselves. Which response best addresses the central security requirement with a defensible, risk-based design?
- Require designated classification authority for label changes under mandatory policy
- Evaluate trusted subject, resource and context attributes in authorization policy
- Allow each document creator to remove mandatory labels
- Use only file names as label enforcement
Explanation
Correct Answer
A:MAC access decisions are system-enforced, not at the data owner's discretion.
Incorrect Answers
B:ABAC scales fine-grained decisions when attributes are governed. Require designated classification authority for label changes under mandatory policy.
C:Discretionary relabeling defeats MAC.
D:Text naming cannot enforce clearance.
Question 364
A shared project folder permits its owner to delegate read rights but now needs constraints to avoid uncontrolled onward sharing. Which response best addresses the central security requirement with a defensible, risk-based design?
- Remove ownership and give anonymous read to simplify collaboration
- Use mandatory central labels and enforcement controlled by trusted policy authority
- Use owner-managed permissions within enforced organization guardrails and review sharing paths
- Assume every recipient can redistribute access without oversight
Explanation
Correct Answer
C:DAC permits owner decisions but still needs centralized boundary policy.
Incorrect Answers
A:Public access is not controlled DAC.
B:Mandatory access control does not delegate security label decisions to object owners. Use owner-managed permissions within enforced organization guardrails and review sharing paths.
D:Unbounded delegation expands exposure.
Question 365
A user logs in from a new unmanaged device just after multiple impossible-travel alerts. Which response best addresses the central security requirement with a defensible, risk-based design?
- Permanently block all users who ever change devices
- Trust the session solely because its password matched
- Use discretionary access controls where owners can grant permitted rights under organizational constraints
- Require step-up authentication or deny according to risk signals and business policy
Explanation
Correct Answer
D:Adaptive authorization can reduce exposure when context changes.
Incorrect Answers
A:Overly rigid rules may impair legitimate access.
B:Credential validation alone ignores risk.
C:DAC delegates some sharing choices to resource owners. Require step-up authentication or deny according to risk signals and business policy.
Question 366
After a prior policy decision/enforcement finding, a cloud service provider reports that the approved safeguard is implemented: “Ensure policy enforcement points cover every resource path and consult the decision authority.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Run this adjacent but different test as the sole proof: Compare effective permissions of roles to approved job functions
- Accept a signed change ticket saying: Ensure policy enforcement points cover every resource path and consult the decision authority
- Use the completion of this alternative as proof: Update only the policy text without fixing bypass route
- Probe direct and brokered paths with disallowed identity
Explanation
Correct Answer
D:Bypass detection validates enforcement coverage.
Incorrect Answers
A:Role-level tests demonstrate least privilege. It tests rbac, while this case requires evidence about policy decision/enforcement.
B:Probe direct and brokered paths with disallowed identity. Bypass detection validates enforcement coverage.
C:Unmediated calls still succeed. Probe direct and brokered paths with disallowed identity.
Question 367
An incident review documented this rbac exposure: A hospital application gives every nurse database administrator privileges to view patient charts. The response team proposed only “Grant all medical staff one administrator role” and the weakness would remain. Which finding MOST accurately explains why this measure is inadequate?
- Individual exceptions become ungovernable.
- Formal clearance and need to know are still required.
- Shared broad authority defeats separation.
- Untrusted principal attributes enable escalation.
Explanation
Correct Answer
C:Shared broad authority defeats separation. The relevant alternative is shared broad authority defeats separation.
Incorrect Answers
A:This describes the limitation of a different proposed action (Manage permissions through unrelated personal exceptions only); it does not identify the main defect in Grant all medical staff one administrator role.
B:Formal clearance and need to know are still required. The actual criticized measure is shared broad authority defeats separation.
D:Untrusted principal attributes enable escalation. The actual criticized measure is shared broad authority defeats separation.
Question 368
After a prior abac finding, a global logistics firm reports that the approved safeguard is implemented: “Evaluate trusted subject, resource and context attributes in authorization policy.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Use the completion of this alternative as proof: Let users self-assign a privileged department attribute
- Run this adjacent but different test as the sole proof: Test normal versus anomalous contexts and observe differentiated decisions
- Accept a signed change ticket saying: Evaluate trusted subject, resource and context attributes in authorization policy
- Try a forged department attribute and confirm the request is denied
Explanation
Correct Answer
D:Attribute source trust must be validated.
Incorrect Answers
A:Untrusted principal attributes enable escalation. Try a forged department attribute and confirm the request is denied.
B:Policy effectiveness requires context sensitivity. It tests risk-based access, while this case requires evidence about abac.
C:Try a forged department attribute and confirm the request is denied. Attribute source trust must be validated.
Question 369
After a prior mac finding, a regional hospital network reports that the approved safeguard is implemented: “Use mandatory central labels and enforcement controlled by trusted policy authority.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Attempt owner-driven label downgrades and verify rejection
- Accept a signed change ticket saying: Use mandatory central labels and enforcement controlled by trusted policy authority
- Use the completion of this alternative as proof: Allow each file owner to remove classification labels
- Run this adjacent but different test as the sole proof: Have an authorized owner grant and revoke access and verify changes
Explanation
Correct Answer
A:Enforced labeling demonstrates MAC.
Incorrect Answers
B:Attempt owner-driven label downgrades and verify rejection. Enforced labeling demonstrates MAC.
C:Discretionary overrides undermine mandatory policy. Attempt owner-driven label downgrades and verify rejection.
D:Owner-based permissions should be effective and auditable. It tests dac, while this case requires evidence about mac.
Question 370
After a prior dac finding, a payment-services company reports that the approved safeguard is implemented: “Use discretionary access controls where owners can grant permitted rights under organizational constraints.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Accept a signed change ticket saying: Use discretionary access controls where owners can grant permitted rights under organizational constraints
- Use the completion of this alternative as proof: Treat all files as centrally immutable mandatory labels
- Have an authorized owner grant and revoke access and verify changes
- Run this adjacent but different test as the sole proof: Probe direct and brokered paths with disallowed identity
Explanation
Correct Answer
C:Owner-based permissions should be effective and auditable.
Incorrect Answers
A:Have an authorized owner grant and revoke access and verify changes. Owner-based permissions should be effective and auditable.
B:Mandatory policy is different from owner discretion. Have an authorized owner grant and revoke access and verify changes.
D:Bypass detection validates enforcement coverage. It tests policy decision/enforcement, while this case requires evidence about dac.
Certified Information Systems Security Professional (CISSP) Practice Tests