CAS-005 · Question #349
An organization wants to implement an access control system based on its data classification policy that includes the following data types: - Confidential - Restricted - Internal - Public Flag for…
The correct answer is A. A tagging strategy in which all resources are assigned a tag based on the data classification type. Tagging strategy: All resources (e.g., systems, files, databases) can be assigned tags based on their classification type (Confidential, Restricted, Internal, Public Flag for Review). This allows the access control system to easily associate resources with their respective data…
Question
An organization wants to implement an access control system based on its data classification policy that includes the following data types:
- Confidential
- Restricted
- Internal
- Public Flag for Review
The access control system should support SSO federation to map users into groups. Each group should only access systems that process and store data at the classification assigned to the group. Which of the following should the organization implement to enforce its requirements with a minimal impact to systems and resources?
Options
- AA tagging strategy in which all resources are assigned a tag based on the data classification type,
- BRole-based access control that maps data types to internal roles, which are defined in the human
- CNetwork microsegmentation based on data types, and a network access control system enforcing
- DA rule-based access control strategy enforced by the SSO system with rules managed by the
How the community answered
(35 responses)- A80% (28)
- B6% (2)
- C3% (1)
- D11% (4)
Explanation
Tagging strategy: All resources (e.g., systems, files, databases) can be assigned tags based on their classification type (Confidential, Restricted, Internal, Public Flag for Review). This allows the access control system to easily associate resources with their respective data classifications without needing significant changes to the underlying systems. Attribute-based access control (ABAC): ABAC allows access control decisions to be based on attributes (such as user group, resource tags, or data classification). By using ABAC, the system can enforce rules dynamically, allowing users in specific groups (mapped through SSO federation) to only access resources that match their assigned data classification.
Community Discussion
No community discussion yet for this question.