200-201 Question 62
Select 2A cybersecurity analyst is configuring access control for a file server that contains sensitive documents. The organization has implemented rule-based access control (RBAC) to manage permissions. Which of the following scenarios aligns with rule-based access control principles?
- A
Users from the HR department are allowed to access payroll files only between 9:00 AM and 5:00 PM on weekdays.
- B
Access to the server is granted based on the user's role within the organization, such as 'Manager' or 'Employee.'
- C
Network administrators are permitted to access the server only if they are connected through a secure VPN.
- D
Permissions on the server are automatically adjusted based on the user's behavior and activity patterns.
- E
A user is granted access to specific files based on their seniority level in the organization.
Show answer and explanation
Correct answers: A, C
Explanation
Rule-based access control (RBAC) enforces access based on specific, predefined conditions or rules. Correct examples include granting access based on rules such as time, location, or connection method. Scenarios that involve roles, behaviors, or discretionary decisions do not align with rule-based access control principles.
- A. Correct.
This aligns with rule-based access control because access is granted based on specific rules, such as department, time of day, and day of the week.
- B. Incorrect.
This describes role-based access control (RBAC), where access is granted based on predefined roles, not specific rules.
- C. Correct.
This is an example of rule-based access control since access is granted based on a specific condition, such as being connected through a secure VPN.
- D. Incorrect.
This describes behavior-based or adaptive access control, not rule-based access control.
- E. Incorrect.
This scenario is not rule-based but could be considered a form of discretionary or role-based access control depending on the implementation.