nerdexam
EC-Council

212-82 · Question #116

In a multinational corporation, the IT department Implemented a new network security protocol for their global data centers. This protocol was designed to enhance security measures by incorporating…

The correct answer is B. Discretionary Access Control (DAC). where the resource owner decides on the access. An incident where an unauthorized user gained access to confidential data by exploiting an aspect of the access control system most likely points to a vulnerability in how resource owners manage permissions.

Submitted by tunde_lagos· Mar 6, 2026Cloud Security Architecture

Question

In a multinational corporation, the IT department Implemented a new network security protocol for their global data centers. This protocol was designed to enhance security measures by incorporating advanced access control principles. The protocol employs a combination of methods to ensure that only authorized personnel can access sensitive data. Recently, an incident occurred where an unauthorized user gained access to confidential data. The security team discovered that the intruder exploited a specific aspect of the access control system. Which aspect of the access control principles, terminologies, and models was most likely exploited?

Options

  • AAttribute-Based Access Control {ABAC), where access decisions are made based on a set of
  • BDiscretionary Access Control (DAC). where the resource owner decides on the access
  • CRole-Based Access Control (RBAC). where access is given based on the roles within the
  • DMandatory Access Control (MAC), where access decisions are made based on predefined rules

How the community answered

(30 responses)
  • A
    10% (3)
  • B
    73% (22)
  • C
    3% (1)
  • D
    13% (4)

Why each option

An incident where an unauthorized user gained access to confidential data by exploiting an aspect of the access control system most likely points to a vulnerability in how resource owners manage permissions.

AAttribute-Based Access Control {ABAC), where access decisions are made based on a set of

Attribute-Based Access Control (ABAC) decisions are based on multiple attributes and policies, making it less likely for a single 'aspect' related to ownership discretion to be exploited for broad unauthorized access.

BDiscretionary Access Control (DAC). where the resource owner decides on the accessCorrect

Discretionary Access Control (DAC) is most likely exploited, as it allows resource owners to determine access permissions. An intruder could gain unauthorized access if an owner inadvertently grants excessive rights, has their credentials compromised allowing permission modification, or misconfigures access, leading to confidential data exposure.

CRole-Based Access Control (RBAC). where access is given based on the roles within the

Role-Based Access Control (RBAC) centrally manages permissions based on predefined roles. An exploitation would more likely target role assignment or definition rather than a discretionary aspect allowing an unauthorized user to gain access.

DMandatory Access Control (MAC), where access decisions are made based on predefined rules

Mandatory Access Control (MAC) is highly rigid and system-enforced with strict security labels, making it extremely difficult for an unauthorized user to exploit a discretionary aspect for access as resource owners cannot override system-defined rules.

Concept tested: Access control model vulnerabilities (DAC)

Source: https://learn.microsoft.com/en-us/azure/security/fundamentals/confidentiality-integrity-availability#access-control

Topics

#access control#DAC#identity and access management#security breaches

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 212-82 Practice