Access Control Slide Set #4 Textbook Chapter 4 Clicker Questions                     Peer Instruction Questions for Intro to Computer Security by William E. Johnson, Allison Luzader, Irfan Ahmed is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.

Discretionary access control Mandatory access control Consider and identify the following access control policy. Access is controlled based on comparing security labels indicating sensitivity of system resources with security clearances. An entity with access to a certain resource may not enable another entity to access that resource. Discretionary access control Mandatory access control Role based access control None/Other/More than one of the above Correct Answer = B Source: Computer Security Principles and Practice, Third Edition, page 152 Question Triggers: “Use ‘none of the above’”: due to the provided choice “Identify a set or subset” due to the possibility of multiple choices “Analysis and reasoning” due to the requirement of feature identification in the question for each form of access control “Qualitative questions” as this requires an understanding of each form of access control as well as the differences of each Total count: 4 Count without none of the above: 3 Count without identify a set: 3 Count without none of the above or identify a set: 2 Complexity: Simple, as this question is asking to identify a basic form of access control based on the description Presentation: Feature Identification

Discretionary access control Mandatory access control Consider and identify the following access control policy. Access is controlled based on the identity of the requestor and on access rules that state what requestors are allowed to do. An entity might be able to permit another entity to access a particular resource. Discretionary access control Mandatory access control Role based access control None/Other/More than one of the above Correct Answer = A Source: Computer Security Principles and Practice, Third Edition, page 152 Question Triggers: “Use ‘none of the above’”: due to the provided choice “Identify a set or subset” due to the possibility of multiple choices “Analysis and reasoning” due to the requirement of feature identification in the question for each form of access control “Qualitative questions” as this requires an understanding of each form of access control as well as the differences of each Total count: 4 Count without none of the above: 3 Count without identify a set: 3 Count without none of the above or identify a set: 2 Complexity: Simple, as this question is asking to identify a basic form of access control based on the description Presentation: Feature Identification

Discretionary access control Mandatory access control Consider and identify the following access control policy. Controls access based on the roles that users have within the system and on rules stating what accesses are allowed to users in given roles. Discretionary access control Mandatory access control Role based access control None/Other/More than one of the above Correct Answer = C Source: Computer Security Principles and Practice, Third Edition, page 152 Question Triggers: “Use ‘none of the above’”: due to the provided choice “Identify a set or subset” due to the possibility of multiple choices “Analysis and reasoning” due to the requirement of feature identification in the question for each form of access control “Qualitative questions” as this requires an understanding of each form of access control as well as the differences of each Total count: 4 Count without none of the above: 3 Count without identify a set: 3 Count without none of the above or identify a set: 2 Complexity: Simple, as this question is asking to identify a basic form of access control based on the description Presentation: Feature Identification