200-201 Question 61
Select 2An organization is implementing a rule-based access control (RBAC) system for securing access to their database. The security team applies a rule stating, 'Only users in the 'HR' group can access the employee records table during business hours (8:00 AM to 6:00 PM) from devices within the corporate network.' Which of the following statements correctly aligns with the principles of rule-based access control in this scenario?
- A
The rule applies uniformly to all users regardless of their job role or department.
- B
Access is granted based on specific conditions, such as group membership and time of access.
- C
The system dynamically evaluates user behavior before applying the rule to ensure compliance.
- D
The rule enforces access restrictions based on predefined policies, not individual user discretion.
- E
Rule-based access control requires manual intervention to apply the rules for each access attempt.
Show answer and explanation
Correct answers: B, D
Explanation
Rule-based access control (RBAC) is a policy-driven access control mechanism where access is granted or denied based on predefined rules. In this scenario, the rule specifies conditions such as group membership ('HR'), time constraints (business hours), and device location (corporate network). Options 2 and 4 correctly reflect the principles of RBAC: access is based on specific rules, and these rules are enforced automatically without relying on individual discretion or manual intervention.
- A. Incorrect.
Incorrect: Rule-based access control does not apply uniformly to all users. Rules are defined based on specific attributes or conditions, such as group membership or roles.
- B. Correct.
Correct: Rule-based access control allows or denies access based on predefined conditions, such as group membership, time of access, and network location.
- C. Incorrect.
Incorrect: Rule-based access control does not involve dynamic evaluation of user behavior. It strictly follows prewritten rules and conditions.
- D. Correct.
Correct: Rule-based access control enforces access restrictions based on predefined policies and conditions, ensuring consistency in access control practices.
- E. Incorrect.
Incorrect: Rule-based access control does not require manual intervention for each access attempt. Rules are applied automatically by the system.