CECS 378 EXAM QUESTIONS ANSWERED CORRECTLY LATEST UPDATE 2026
What is access control as defined by NIST IR 7298? - Answers The process of granting or denying
specific requests to obtain and use information and related information processing services, and to
enter specific physical facilities.
How does RFC 4949 define access control? - Answers A process by which use of system resources is
regulated according to a security policy and permitted only by authorized entities according to that
policy.
What is one basic security requirement for access control? - Answers Limit information system access
to authorized users, processes acting on behalf of authorized users, or devices.
What does the principle of least privilege entail? - Answers Employing the least privilege for specific
security functions and privileged accounts.
What should be done to prevent non-privileged users from executing privileged functions? - Answers
Prevent non-privileged users from executing privileged functions and audit the execution of such
functions.
What is a recommended action after a defined period of inactivity? - Answers Terminate a user
session automatically.
What is the purpose of using session locks with pattern-hiding displays? - Answers To prevent access
and viewing of data after a period of inactivity.
What should be done to protect remote access sessions? - Answers Employ cryptographic
mechanisms to protect the confidentiality of remote access sessions.
What is required before allowing wireless access? - Answers Authorize wireless access prior to
allowing such connections.
What should be done to control the connection of mobile devices? - Answers Control connection of
mobile devices and encrypt controlled unclassified information (CUI) on them.
What is the significance of monitoring remote access sessions? - Answers To ensure control and
security during remote access.
What does CUI stand for? - Answers Controlled Unclassified Information.
What is the relationship between access control and computer security? - Answers All of computer
security is concerned with access control, which assures security services in a computer system.
What should be done with organizational portable storage devices on external information systems? -
Answers Limit use of organizational portable storage devices on external information systems.
What is a derived security requirement related to the flow of CUI? - Answers Control the flow of CUI
in accordance with approved authorizations.
What should be provided to users regarding privacy and security? - Answers Provide privacy and
security notices consistent with applicable CUI rules.
What is the purpose of limiting unsuccessful logon attempts? - Answers To enhance security by
preventing unauthorized access.
What does computer security aim to assure according to RFC 4949? - Answers Security services in a
computer system, particularly those that assure access control service.
What is one way to protect wireless access? - Answers Using authentication and encryption.
What is Discretionary Access Control (DAC)? - Answers Access control based on the identity of the
requestor and specific access rules.
What does Mandatory Access Control (MAC) rely on? - Answers It controls access based on security
labels compared to security clearances.
What is Role-Based Access Control (RBAC)? - Answers Access control based on the roles users have
within the system.
Define Attribute-Based Access Control (ABAC). - Answers Access control based on attributes of the
user, resource, and environmental conditions.
What is a Subject in access control? - Answers An entity capable of accessing objects.
What are the three classes of Subjects? - Answers Owner, Group, World.
What is an Object in access control? - Answers A resource that access is controlled for.
What does Access Right describe? - Answers The way a subject may access an object, such as read or
write.
What is an Access Matrix? - Answers A scheme that shows access rights of subjects to objects.
What is a Protection Domain? - Answers A set of objects with associated access rights.
What is access control as defined by NIST IR 7298? - Answers The process of granting or denying
specific requests to obtain and use information and related information processing services, and to
enter specific physical facilities.
How does RFC 4949 define access control? - Answers A process by which use of system resources is
regulated according to a security policy and permitted only by authorized entities according to that
policy.
What is one basic security requirement for access control? - Answers Limit information system access
to authorized users, processes acting on behalf of authorized users, or devices.
What does the principle of least privilege entail? - Answers Employing the least privilege for specific
security functions and privileged accounts.
What should be done to prevent non-privileged users from executing privileged functions? - Answers
Prevent non-privileged users from executing privileged functions and audit the execution of such
functions.
What is a recommended action after a defined period of inactivity? - Answers Terminate a user
session automatically.
What is the purpose of using session locks with pattern-hiding displays? - Answers To prevent access
and viewing of data after a period of inactivity.
What should be done to protect remote access sessions? - Answers Employ cryptographic
mechanisms to protect the confidentiality of remote access sessions.
What is required before allowing wireless access? - Answers Authorize wireless access prior to
allowing such connections.
What should be done to control the connection of mobile devices? - Answers Control connection of
mobile devices and encrypt controlled unclassified information (CUI) on them.
What is the significance of monitoring remote access sessions? - Answers To ensure control and
security during remote access.
What does CUI stand for? - Answers Controlled Unclassified Information.
What is the relationship between access control and computer security? - Answers All of computer
security is concerned with access control, which assures security services in a computer system.
What should be done with organizational portable storage devices on external information systems? -
Answers Limit use of organizational portable storage devices on external information systems.
What is a derived security requirement related to the flow of CUI? - Answers Control the flow of CUI
in accordance with approved authorizations.
What should be provided to users regarding privacy and security? - Answers Provide privacy and
security notices consistent with applicable CUI rules.
What is the purpose of limiting unsuccessful logon attempts? - Answers To enhance security by
preventing unauthorized access.
What does computer security aim to assure according to RFC 4949? - Answers Security services in a
computer system, particularly those that assure access control service.
What is one way to protect wireless access? - Answers Using authentication and encryption.
What is Discretionary Access Control (DAC)? - Answers Access control based on the identity of the
requestor and specific access rules.
What does Mandatory Access Control (MAC) rely on? - Answers It controls access based on security
labels compared to security clearances.
What is Role-Based Access Control (RBAC)? - Answers Access control based on the roles users have
within the system.
Define Attribute-Based Access Control (ABAC). - Answers Access control based on attributes of the
user, resource, and environmental conditions.
What is a Subject in access control? - Answers An entity capable of accessing objects.
What are the three classes of Subjects? - Answers Owner, Group, World.
What is an Object in access control? - Answers A resource that access is controlled for.
What does Access Right describe? - Answers The way a subject may access an object, such as read or
write.
What is an Access Matrix? - Answers A scheme that shows access rights of subjects to objects.
What is a Protection Domain? - Answers A set of objects with associated access rights.
