Access control models (MAC, DAC, ABAC) in Cybersecurity - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Mandatory Access Control (MAC)

Which statement best describes how Mandatory Access Control (MAC) manages access permissions?

A Access decisions are based on labels assigned to users and resources, enforced by the system.

B Users can set access permissions on their own files and resources.

C Access is granted based on user roles and their assigned permissions.

D Access permissions are granted dynamically based on user attributes and environmental conditions.

💡 Hint

Think about who controls the access rules in MAC.

In Mandatory Access Control, the system enforces access based on security labels assigned to both users and resources. Users cannot change these permissions themselves.

📋 Factual

intermediate

Discretionary Access Control (DAC) Characteristics

Which of the following is a key characteristic of Discretionary Access Control (DAC)?

A Access is determined by matching user attributes to policies.

B Access rights are assigned by a central authority and cannot be changed by users.

C Users have the ability to grant or revoke access to resources they own.

D Access decisions are based on predefined security labels.

💡 Hint

Consider who controls permissions in DAC.

In DAC, the owner of a resource can decide who else can access it, allowing users to grant or revoke permissions.

🔍 Analysis

advanced

Comparing ABAC with DAC and MAC

Which feature uniquely distinguishes Attribute-Based Access Control (ABAC) from both DAC and MAC?

A Users can freely assign permissions to their resources.

B Access is granted based on evaluating multiple attributes of users, resources, and environment dynamically.

C Access permissions are static and cannot change during a session.

D Access decisions are based on fixed security labels assigned by the system.

💡 Hint

Think about how ABAC uses information beyond just ownership or labels.

ABAC evaluates various attributes such as user role, resource type, time of access, and location to make flexible access decisions.

❓ Reasoning

advanced

Identifying Access Control Model by Scenario

A company enforces access where only users with a security clearance level equal to or higher than the document's classification can view it. Users cannot change these permissions. Which access control model is this?

A Role-Based Access Control (RBAC)

B Attribute-Based Access Control (ABAC)

C Discretionary Access Control (DAC)

D Mandatory Access Control (MAC)

💡 Hint

Consider who controls the permissions and how they are enforced.

This scenario describes MAC, where access is controlled by system-enforced labels like security clearance and classification levels.

❓ Comparison

expert

Evaluating Access Control Models for Dynamic Environments

In a cloud environment where access must adapt to changing user roles, device security status, and time of day, which access control model is most suitable?

A Attribute-Based Access Control (ABAC)

B Mandatory Access Control (MAC)

C Discretionary Access Control (DAC)

D Role-Based Access Control (RBAC)

💡 Hint

Think about which model supports flexible, attribute-driven decisions.

ABAC supports dynamic access decisions based on multiple attributes like user role, device status, and time, making it ideal for cloud environments.