N10-009 Question 250
Single answerAuthorization: Least privilege, Role-based access control, GeofencingA company allows employees to access an internal inventory application through a VPN. The network administrator discovers that several warehouse contractors can view payroll data in the application, even though they only need to update shipment records. The company also wants to block administrative logins to the VPN portal from countries where it does not operate. Which solution BEST addresses both requirements while following security best practices?
- A
Create separate role-based access control groups for warehouse contractors and payroll staff, assign only the required permissions to each role, and apply a geofencing policy to restrict administrative VPN logins to approved countries
- B
Place all employees and contractors into one access group, require longer passwords for payroll data, and disable VPN access from all foreign IP addresses
- C
Grant contractors temporary administrator rights to the inventory application, then rely on login auditing to detect unauthorized payroll access, and configure port security on the VPN concentrator
- D
Use a shared payroll account for supervisors, allow contractors read-only access to all application modules, and restrict VPN access based only on time of day
Show answer and explanation
Correct answer: A
Explanation
The best answer is the one that applies authorization controls correctly and practically. Least privilege means users should receive only the permissions necessary to perform their job duties. In this scenario, warehouse contractors should be able to update shipment records but should not be able to view payroll data. Role-based access control is the standard way to enforce this by assigning permissions to roles rather than individually managing every user. Geofencing adds another authorization-related access restriction by allowing or denying access based on geographic location, which is appropriate for limiting administrative VPN logins to approved countries. These practices align with common security guidance such as NIST recommendations on least privilege and access control, and they reflect standard enterprise identity and access management best practices used in production environments.
- A. Correct.
Correct. This option combines role-based access control (RBAC), least privilege, and geofencing appropriately. RBAC allows the organization to define roles such as warehouse contractor and payroll staff, then assign permissions based on job function. Applying only the minimum permissions needed satisfies the principle of least privilege and prevents contractors from accessing payroll data they do not need. Geofencing administrative VPN logins to approved countries is also an appropriate control to reduce the risk of unauthorized access from unexpected geographic regions.
- B. Incorrect.
Incorrect. Putting everyone into one access group violates RBAC and least privilege because it does not separate permissions by job role. Requiring longer passwords for payroll data does not solve the authorization problem of contractors having unnecessary access. Blocking all foreign IP addresses may sound similar to geofencing, but it is overly broad and may disrupt legitimate remote access; the requirement specifically focuses on restricting administrative logins to countries where the company operates.
- C. Incorrect.
Incorrect. Granting contractors temporary administrator rights directly contradicts least privilege by providing far more access than required. Auditing is useful for detection and accountability, but it does not prevent unauthorized access. Port security is a switch-based control for limiting devices on physical switch ports and is not the appropriate control for managing VPN portal authorization or geographic access restrictions.
- D. Incorrect.
Incorrect. Shared accounts are a poor security practice because they remove accountability and make auditing difficult. Allowing contractors read-only access to all application modules still violates least privilege if payroll information is unnecessary for their job. Restricting VPN access only by time of day does not address the stated requirement to limit administrative logins based on geographic location.