Which of the following statements pertaining to access control is false?

The correct answer is B. If access is not explicitly denied, it should be implicitly allowed. The correct security principle is 'default deny' or 'implicit deny': if access is not explicitly granted, it should be denied. Allowing access unless explicitly denied ('default allow') is a major security flaw because it means any unaddressed resource is open to everyone. The…

Submitted by sofia.br· Apr 18, 2026Access Controls

Question

Options

AUsers should only access data on a need-to-know basis.
BIf access is not explicitly denied, it should be implicitly allowed.
CAccess rights should be granted based on the level of trust a company has on a subject.
DRoles can be an efficient way to assign rights to a type of user who performs certain tasks.

How the community answered

(16 responses)

A
6% (1)
B
88% (14)
C
6% (1)

Explanation

The correct security principle is 'default deny' or 'implicit deny': if access is not explicitly granted, it should be denied. Allowing access unless explicitly denied ('default allow') is a major security flaw because it means any unaddressed resource is open to everyone. The other statements are all valid access control principles: need-to-know limits data exposure, trust levels guide rights assignment, and roles streamline permission management.

Topics

#Access Control Principles#Implicit Deny#Least Privilege#Role-Based Access Control (RBAC)

Community Discussion

No community discussion yet for this question.

Full SSCP Practice