Role-based access control (RBAC) in Cybersecurity - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding the core concept of RBAC

Which of the following best describes the main idea behind Role-based Access Control (RBAC)?

A Access permissions are assigned directly to individual users based on their identity.

B Access is granted randomly to users without any predefined roles or permissions.

C Access permissions are assigned to roles, and users gain permissions by being assigned to those roles.

D Users can access any resource as long as they know the password, regardless of roles.

💡 Hint

Think about how permissions are grouped and assigned in RBAC.

RBAC assigns permissions to roles, not directly to users. Users get permissions by being assigned roles, which simplifies management.

📋 Factual

intermediate

Key components of RBAC

Which of the following is NOT a standard component of RBAC?

A Users

B Roles

C Permissions

D Encryption keys

💡 Hint

Consider what RBAC manages directly versus what is used for data protection.

RBAC manages users, roles, and permissions. Encryption keys are related to data security but not a core RBAC component.

🚀 Application

advanced

Applying RBAC in a company scenario

A company has roles: 'Employee', 'Manager', and 'Admin'. Only 'Admin' can delete records. If a user is assigned both 'Employee' and 'Manager' roles, which actions can they perform?

A They can delete records because they have multiple roles.

B They cannot delete records because only 'Admin' can delete records.

C They can delete records only if 'Manager' role allows it.

D They can delete records if they request permission from 'Admin'.

💡 Hint

Think about how permissions are combined from assigned roles.

Permissions are the union of assigned roles. Since neither 'Employee' nor 'Manager' roles allow deleting records, the user cannot delete records.

🔍 Analysis

advanced

Analyzing RBAC benefits

Which of the following is a primary benefit of using RBAC in an organization?

A It simplifies management by grouping permissions into roles.

B It automatically detects security breaches.

C It allows users to have unlimited access to all resources.

D It eliminates the need for passwords.

💡 Hint

Consider how RBAC affects permission management.

RBAC simplifies access management by assigning permissions to roles instead of individual users, making it easier to manage large numbers of users.

❓ Reasoning

expert

Reasoning about RBAC constraints

In RBAC, what is the purpose of a 'separation of duties' constraint?

A To prevent a single user from having conflicting permissions that could lead to fraud or error.

B To allow users to have all permissions to speed up work.

C To assign all permissions to the 'Admin' role only.

D To automatically assign roles based on user preferences.

💡 Hint

Think about why some permissions should not be combined in one user.

Separation of duties ensures that no single user has conflicting permissions that could allow misuse or mistakes, enhancing security.