WGU C845
WGU C845 VUN1 Task 1, 2 & 3 Information Systems Security
- C845 | 100% Guaranteed Pass || Complete A+ Guide
Gradegurus
➢
➢
➢
➢
,WGU C845 VUN1 Task 1, 2, & 3 Study Guide
Task 1: Managing Security Operations and Access Controls
This task focuses on analyzing an organization's access control
methods and security operations to identify weaknesses and provide
remediation strategies.
Part A: Apply an Access Control Model
A1. Choose and Justify an Access Control Model
Recommended Model: Role-Based Access Control (RBAC) 2 5 .
Key Principles to Discuss:
Role Assignment: Users are assigned permissions based on their
specific job
functions (e.g., "Finance Manager," "HR Coordinator") 5 .
Permission Assignment: Permissions are granted to roles,
not directly to individual users. This streamlines management
.
6
, Session Management: A user activates a role to gain its
associated permissions.
Least Privilege: The core principle that users should only have the
minimum
access necessary to perform their duties 2 5 .
A2. Identify Four Misalignments with RBAC Principles
Using the provided "Security Operations Artifact," identify four specific
instances where current access violates RBAC principles.
1. Misalignment 1: Privilege Escalation Beyond Role Scope
Example: A "Junior System Administrator" (J. Lopez) is granted
"Domain
Admin" privileges 2 6 .
Conflict: This violates the principle of least privilege. A junior
role should not have the highest level of administrative control.
2. Misalignment 2: Unnecessary Cross-Departmental Access
Example: A "Finance Analyst" (L. Cheng) has "Full Access" to the
Customer Relationship Management (CRM) system, which is
typically used by Sales
and Support 2 5 .
Conflict: This violates least privilege and separation of
duties. It allows a user to access and modify data outside their
core business function.
3. Misalignment 3: Violation of User-Role Assignment Post-Termination
Example: A terminated employee (P. Ellis) still has an "Active"
account with "read and write" access to the HR portal and payroll
system. Logs show they
successfully logged in after their termination date 2 6 .
Conflict: This violates the duration aspect of RBAC. Access
WGU C845 VUN1 Task 1, 2 & 3 Information Systems Security
- C845 | 100% Guaranteed Pass || Complete A+ Guide
Gradegurus
➢
➢
➢
➢
,WGU C845 VUN1 Task 1, 2, & 3 Study Guide
Task 1: Managing Security Operations and Access Controls
This task focuses on analyzing an organization's access control
methods and security operations to identify weaknesses and provide
remediation strategies.
Part A: Apply an Access Control Model
A1. Choose and Justify an Access Control Model
Recommended Model: Role-Based Access Control (RBAC) 2 5 .
Key Principles to Discuss:
Role Assignment: Users are assigned permissions based on their
specific job
functions (e.g., "Finance Manager," "HR Coordinator") 5 .
Permission Assignment: Permissions are granted to roles,
not directly to individual users. This streamlines management
.
6
, Session Management: A user activates a role to gain its
associated permissions.
Least Privilege: The core principle that users should only have the
minimum
access necessary to perform their duties 2 5 .
A2. Identify Four Misalignments with RBAC Principles
Using the provided "Security Operations Artifact," identify four specific
instances where current access violates RBAC principles.
1. Misalignment 1: Privilege Escalation Beyond Role Scope
Example: A "Junior System Administrator" (J. Lopez) is granted
"Domain
Admin" privileges 2 6 .
Conflict: This violates the principle of least privilege. A junior
role should not have the highest level of administrative control.
2. Misalignment 2: Unnecessary Cross-Departmental Access
Example: A "Finance Analyst" (L. Cheng) has "Full Access" to the
Customer Relationship Management (CRM) system, which is
typically used by Sales
and Support 2 5 .
Conflict: This violates least privilege and separation of
duties. It allows a user to access and modify data outside their
core business function.
3. Misalignment 3: Violation of User-Role Assignment Post-Termination
Example: A terminated employee (P. Ellis) still has an "Active"
account with "read and write" access to the HR portal and payroll
system. Logs show they
successfully logged in after their termination date 2 6 .
Conflict: This violates the duration aspect of RBAC. Access
