WGU C845 VUN1 Task 1: Access Control Model &
Policy Recommendations Study Guide
Updated 2026/2027 Syllabus | New Version
Part 1: Foundational Concepts & Access Control Models
1. What are the three core objectives of information security that any access
control model aims to enforce?
ANSWER ✓ Confidentiality, Integrity, and Availability (CIA Triad). Confidentiality ensures
data is accessible only to authorized users; Integrity safeguards the accuracy and
completeness of data; Availability ensures data is accessible when needed.
2. For VUN1 Task 1, which specific access control model must you analyze and
apply to the scenario?
ANSWER ✓ Role-Based Access Control (RBAC). In this model, access permissions are
granted based on a user's assigned role within the organization, not their individual
identity.
3. Define the principle of "least privilege" and explain its importance in access
control.
ANSWER ✓ The principle of least privilege means granting users only the minimum
levels of access—or permissions—needed to perform their job functions. Its importance
lies in limiting the potential damage from accidents, errors, or unauthorized use of
privileged access .
4. Explain the concept of "separation of duties" (SoD) and why it is a critical
control.
ANSWER ✓ Separation of duties is a security principle that prevents a single individual
from having excessive control over a critical process or transaction. It requires that
sensitive tasks be divided among multiple people to reduce the risk of fraud and error.
For example, the person who requests a purchase should not also be the one who
approves it.
, 5. What is the difference between authentication and authorization?
ANSWER ✓ Authentication is the process of verifying who a user is (e.g., with a password
and username). Authorization is the process of determining what an authenticated user
is allowed to access and do (e.g., which files they can read or edit).
6. Name two major security frameworks or standards that your recommendations
in VUN1 Task 1 should align with.
ANSWER ✓ NIST SP 800-53 (Security and Privacy Controls for Information Systems and
Organizations) and ISO/IEC 27001:2022 (Information Security, Cybersecurity and Privacy
— Information Security Management Systems — Requirements) .
7. What is a "privilege escalation" attack?
ANSWER ✓ A privilege escalation attack occurs when a user or attacker gains elevated
access to resources that are normally protected from an application or user. This can
happen by exploiting a bug, design flaw, or configuration oversight to gain higher-level
permissions than intended .
8. What is the difference between horizontal and vertical privilege escalation?
ANSWER ✓ Horizontal privilege escalation occurs when a user gains the access rights of
another user who has the same level of permissions. Vertical privilege escalation (or
privilege elevation) occurs when a user gains access to rights or functions of a higher-
level user, such as an application or administrator.
9. What is a "discretionary access control" (DAC) model?
ANSWER ✓ In a DAC model, the owner of the resource (like a file or folder) has full
discretion over who can access it and what permissions they have. The owner can grant
or revoke access to other users.
10. What is a "mandatory access control" (MAC) model?
ANSWER ✓ In a MAC model, the operating system or security kernel enforces access
controls based on a set of labels and classifications. Users cannot override these
controls, even if they are the owner of the resource. It is common in high-security
environments.
11. What is an "attribute-based access control" (ABAC) model?
, ANSWER ✓ ABAC is a logical access control model that grants access based on a
combination of attributes. These attributes can be related to the user (e.g., department),
the resource (e.g., classification), the action (e.g., read), and the environment (e.g., time
of day).
12. Why is RBAC often preferred over DAC in large organizations like the one in
VUN1?
ANSWER ✓ RBAC is preferred because it is more scalable and manageable. In DAC, an
administrator would have to manage permissions for hundreds of individual users. In
RBAC, they manage permissions for a smaller number of roles, and users are simply
assigned to those roles, simplifying administration and reducing errors.
13. What is NIST Special Publication 800-53?
ANSWER ✓ NIST SP 800-53 is a publication that provides a catalog of security and
privacy controls for federal information systems and organizations. It is a widely used
standard for selecting and implementing security measures, including access controls .
14. What is the primary focus of ISO/IEC 27001:2022?
ANSWER ✓ ISO/IEC 27001:2022 is an international standard for Information Security
Management Systems (ISMS). It provides a framework for establishing, implementing,
maintaining, and continually improving an organization's information security, including
controls for access management .
15. What is the difference between a threat, a vulnerability, and a risk?
ANSWER ✓ A threat is a potential danger that could exploit a vulnerability. A
vulnerability is a weakness in a system or its controls. A risk is the likelihood and
potential impact of a threat exploiting a vulnerability.
Part 2: RBAC Concepts & Implementation
16. In an RBAC model, what are the three primary rules that define it?
ANSWER ✓ 1. Role Assignment: A subject can exercise a permission only if the subject
has been assigned a role. 2. Role Authorization: A subject's active role must be
authorized for them. 3. Permission Authorization: A subject can exercise a permission
only if the permission is authorized for the subject's active role.
Policy Recommendations Study Guide
Updated 2026/2027 Syllabus | New Version
Part 1: Foundational Concepts & Access Control Models
1. What are the three core objectives of information security that any access
control model aims to enforce?
ANSWER ✓ Confidentiality, Integrity, and Availability (CIA Triad). Confidentiality ensures
data is accessible only to authorized users; Integrity safeguards the accuracy and
completeness of data; Availability ensures data is accessible when needed.
2. For VUN1 Task 1, which specific access control model must you analyze and
apply to the scenario?
ANSWER ✓ Role-Based Access Control (RBAC). In this model, access permissions are
granted based on a user's assigned role within the organization, not their individual
identity.
3. Define the principle of "least privilege" and explain its importance in access
control.
ANSWER ✓ The principle of least privilege means granting users only the minimum
levels of access—or permissions—needed to perform their job functions. Its importance
lies in limiting the potential damage from accidents, errors, or unauthorized use of
privileged access .
4. Explain the concept of "separation of duties" (SoD) and why it is a critical
control.
ANSWER ✓ Separation of duties is a security principle that prevents a single individual
from having excessive control over a critical process or transaction. It requires that
sensitive tasks be divided among multiple people to reduce the risk of fraud and error.
For example, the person who requests a purchase should not also be the one who
approves it.
, 5. What is the difference between authentication and authorization?
ANSWER ✓ Authentication is the process of verifying who a user is (e.g., with a password
and username). Authorization is the process of determining what an authenticated user
is allowed to access and do (e.g., which files they can read or edit).
6. Name two major security frameworks or standards that your recommendations
in VUN1 Task 1 should align with.
ANSWER ✓ NIST SP 800-53 (Security and Privacy Controls for Information Systems and
Organizations) and ISO/IEC 27001:2022 (Information Security, Cybersecurity and Privacy
— Information Security Management Systems — Requirements) .
7. What is a "privilege escalation" attack?
ANSWER ✓ A privilege escalation attack occurs when a user or attacker gains elevated
access to resources that are normally protected from an application or user. This can
happen by exploiting a bug, design flaw, or configuration oversight to gain higher-level
permissions than intended .
8. What is the difference between horizontal and vertical privilege escalation?
ANSWER ✓ Horizontal privilege escalation occurs when a user gains the access rights of
another user who has the same level of permissions. Vertical privilege escalation (or
privilege elevation) occurs when a user gains access to rights or functions of a higher-
level user, such as an application or administrator.
9. What is a "discretionary access control" (DAC) model?
ANSWER ✓ In a DAC model, the owner of the resource (like a file or folder) has full
discretion over who can access it and what permissions they have. The owner can grant
or revoke access to other users.
10. What is a "mandatory access control" (MAC) model?
ANSWER ✓ In a MAC model, the operating system or security kernel enforces access
controls based on a set of labels and classifications. Users cannot override these
controls, even if they are the owner of the resource. It is common in high-security
environments.
11. What is an "attribute-based access control" (ABAC) model?
, ANSWER ✓ ABAC is a logical access control model that grants access based on a
combination of attributes. These attributes can be related to the user (e.g., department),
the resource (e.g., classification), the action (e.g., read), and the environment (e.g., time
of day).
12. Why is RBAC often preferred over DAC in large organizations like the one in
VUN1?
ANSWER ✓ RBAC is preferred because it is more scalable and manageable. In DAC, an
administrator would have to manage permissions for hundreds of individual users. In
RBAC, they manage permissions for a smaller number of roles, and users are simply
assigned to those roles, simplifying administration and reducing errors.
13. What is NIST Special Publication 800-53?
ANSWER ✓ NIST SP 800-53 is a publication that provides a catalog of security and
privacy controls for federal information systems and organizations. It is a widely used
standard for selecting and implementing security measures, including access controls .
14. What is the primary focus of ISO/IEC 27001:2022?
ANSWER ✓ ISO/IEC 27001:2022 is an international standard for Information Security
Management Systems (ISMS). It provides a framework for establishing, implementing,
maintaining, and continually improving an organization's information security, including
controls for access management .
15. What is the difference between a threat, a vulnerability, and a risk?
ANSWER ✓ A threat is a potential danger that could exploit a vulnerability. A
vulnerability is a weakness in a system or its controls. A risk is the likelihood and
potential impact of a threat exploiting a vulnerability.
Part 2: RBAC Concepts & Implementation
16. In an RBAC model, what are the three primary rules that define it?
ANSWER ✓ 1. Role Assignment: A subject can exercise a permission only if the subject
has been assigned a role. 2. Role Authorization: A subject's active role must be
authorized for them. 3. Permission Authorization: A subject can exercise a permission
only if the permission is authorized for the subject's active role.
