nerdexam
RSA

050-SEPROGRC-01 · Question #27

At what point should you create user accounts, roles, and groups in Access Control during the Proof-of-Concept build process?

The correct answer is D. After the shells of the applications have been built, but before actual fields have been added. In the RSA Archer PoC build process, user accounts, roles, and groups should be created in Access Control after application shells exist but before fields are added, so permissions can be properly scoped to the application structure.

Solution Design and Best Practices for GRC

Question

At what point should you create user accounts, roles, and groups in Access Control during the Proof-of-Concept build process?

Options

  • AIt should be the first step
  • BAfter the data has been loaded
  • CAfter reports have been created
  • DAfter the shells of the applications have been built, but before actual fields have been added

How the community answered

(47 responses)
  • A
    2% (1)
  • B
    13% (6)
  • C
    6% (3)
  • D
    79% (37)

Why each option

In the RSA Archer PoC build process, user accounts, roles, and groups should be created in Access Control after application shells exist but before fields are added, so permissions can be properly scoped to the application structure.

AIt should be the first step

Creating access control as the absolute first step is premature because roles and groups in RSA Archer are scoped to applications and workspaces that do not yet exist, making meaningful permission configuration impossible.

BAfter the data has been loaded

Waiting until after data is loaded to configure access control means the application structure is already complete, forcing administrators to assign permissions retroactively and risking misconfiguration of field-level security.

CAfter reports have been created

Creating access control after reports are created places it at the very end of the build process, which means user roles could not be validated during intermediate build steps and report-level permissions would need to be re-examined.

DAfter the shells of the applications have been built, but before actual fields have been addedCorrect

Creating access control artifacts after application shells are built ensures that roles and groups can be correctly associated with the applications they will govern. Doing this before fields are added means that as fields are subsequently configured, permissions can be applied incrementally and accurately. This ordering prevents having to retroactively assign access control to a fully built application, reducing errors.

Concept tested: RSA Archer PoC Access Control setup sequence

Source: https://community.rsa.com/t5/archer-platform-documentation/tkb-p/product-documentation

Topics

#proof of concept#access control#user accounts#build sequence

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 050-SEPROGRC-01 Practice