WGU C845 VUN1 Task 1 | Passed on First Attempt |Latest Update with Complete Solution

WGU C845 VUN1 Task 1 | Passed on First Attem zr zr zr zr zr zr zr zr zrzr




pt |Latest Update with Complete Solution
zr zr zr zr zr




VUN1 — zr



VUN1 Task 1: Managing Security Operations and Access Controls Information Sy
zr zr zr zr zr zr zr zr zr zr zr



stems Security - C845zr zr zr




A. Apply an Access Control Model zr zr zr zr




A.1. Chosen Access Control Model zr zr zr




I have chosen the Role-Based Access Control (RBAC) model. The principles of RBAC are:
zr zr zr zr zr zr zr zr zr zr zr zr zr




• Role Assignment: A user is assigned to a role based on their job function (e.g., "Finance
zr zr zr zr zr zr zr zr zr zr zr zr zr zr zr zr


Analyst").
• Permission Assignment: Permissions to perform operations on systems are assigned to roles,
zr zr zr zr zr zr zr zr zr zr zr z


rnot to individual users.
zr zr zr


• Session Management: A user activates a role to gain the associated permissions for a session.
zr zr zr zr zr zr zr zr zr zr zr zr zr zr


• Least Privilege: Users should only have the minimum level of access necessary to perform their
zr zr zr zr zr zr zr zr zr zr zr zr zr zr zr


job duties.
zr




The organization's access control structure, as seen in the user matrix, is implicitly role-
zr zr zr zr zr zr zr zr zr zr zr zr zr


based (e.g., "Finance manager," "HR coordinator"). Applying a formal RBAC model would streamline this
zr zr zr zr zr zr zr zr zr zr zr zr zr z


by ensuring permissions are strictly tied to business functions, reducing complexity and the potential f
r zr zr zr zr zr zr zr zr zr zr zr zr zr zr


or user error when assigning permissions.
zr zr zr zr zr




A.2. Four Misalignments with RBAC Principles zr zr zr zr




1. Misalignment 1: Privilege Escalation Beyond Role Scope zr zr zr zr zr zr


• Description: The "Junior system admin" (J. Lopez) has "Domain admin" privileges. A zr zr zr zr zr zr zr zr zr zr zr zr


junior role should not have the highest level of access in a Windows environment
zr zr zr zr zr zr zr zr zr zr zr zr zr


.
• Conflict with RBAC: This violates the principle of least privilege. The role "Junior system
zr zr zr zr zr zr zr zr zr zr zr zr zr zr


admin" implies a subset of administrative duties, not unrestricted domain-wide control.
zr zr zr zr zr zr zr zr zr zr


2. Misalignment 2: Unnecessary Access Across Departments zr zr zr zr zr


• Description: The "Finance analyst" (L. Cheng) has "Full access" to the CRM, a system zr zr zr zr zr zr zr zr zr zr zr zr zr


messages.downloaded_by

, primarily for Sales and Support. A finance role typically does not require full modification
zr zr zr zr zr zr zr zr zr zr zr zr zr z


rights in a customer relationship system.
r zr zr zr zr zr


• Conflict with RBAC: This violates least privilege and separation of duties. It allows for
zr zr zr zr zr zr zr zr zr zr zr zr zr


potential data manipulation outside the user's core business function.
zr zr zr zr zr zr zr zr zr


3. Misalignment 3: Violation of User-Role Assignment Post-Termination
zr zr zr zr zr zr


• Description: The "HR assistant" (P. Ellis), who was terminated on 2025-05-
zr zr zr zr zr zr zr zr zr zr


20, has an "Active" account status and successfully logged in on 2025-06-29.
zr zr zr zr zr zr zr zr zr zr zr


• Conflict with RBAC: RBAC requires timely revocation of role assignments upon a change
zr zr zr zr zr zr zr zr zr zr zr zr z


in employment status. An active session for a terminated user completely bypasses th
r zr zr zr zr zr zr zr zr zr zr zr zr


e security provided by the role structure.
zr zr zr zr zr zr


4. Misalignment 4: Overly Broad Privileged Access
zr zr zr zr zr


• Description: The "IT administrator" (T. Miller) has "Full admin" access to "All internal
zr zr zr zr zr zr zr zr zr zr zr zr z


systems," and the log shows they made a firewall rule change without a ticket_id.
r zr zr zr zr zr zr zr zr zr zr zr zr zr


• Conflict with RBAC: While some access is necessary, blanket "Full admin" access
zr zr zr zr zr zr zr zr zr zr zr


violates least privilege and impedes accountability. It does not segment duties within the
zr zr zr zr zr zr zr zr zr zr zr zr


IT department itself.
zr zr zr




messages.downloaded_by

, A.3. Recommended Changes to Resolve Misalignments z r z r z r



1. Recommendation1:Implement PrivilegeTieringforAdministrativeRoles z r


• Justification: Following the CIS Control 5 (Account Management) and
z r zr z r zr zr z r z r z r z


the principle of
r zr z r


least privilege,administrativeaccountsshouldbesegregated.The"Juniorsystemadmin"
j z


role should be assigned amorerestricted setofprivileges, such as "Server Operat
r zr zr z r z r zr zr zr zr zr


or" or "Help Desk Administrator," which allows for daily tasks without granting d
zr z r zr zr zr zr zr zr zr zr zr zr


omain-wide control (NIST SP 800-53, AC-6).z r z r z r z r z r


2. Recommendation2:Conduct aRole-PermissionReview andRemediation j


• Justification: Align with ISO/IEC 27001:2022, A.5.35 z r


(Access control) by performing a formal z r z r zr


reviewofall role assignments.Remove accessto systemslikethe zr


CRM from
the "Financeanalyst"roleunlessacompellingbusinessjustificationexists.
zr


Accessshouldbe based on documented job requirements. zr z r z r z r z r


3. Recommendation3:AutomateAccessRevocationandEnforceChangeManagement
• Justification:PerNISTSP800-53,AC-
2(AccountManagement),accountrevocationmust occur immediately upon terminat zr z r z r z r


ion. This should be an automated part of the HR offboarding process. Furt
z r z r z r z r z r z r z r z r zr z r z r z r


hermore, all changes, including firewall modifications, must require aticket ID f
z r z r z r z r zr z r z r zr zr zr


or approval and auditing (CIS Control 10 -
zr zr zr zr zr zr zr


Malware Defenses, relying on change management).
zr zr zr zr z r zr




A.4. Revised User Role Matrix zr zr zr




TherevisedmatrixreflectsastricterRBACimplementation.Keychangesare bolded.

Role Assigned User zr SystemAccess PrivilegeLevel(Revised)
Finance Manager
zr A. Jones zr Payrollsystem,budget tr zr Fullaccess
acker
Financeanalyst L.Chengzr Payrollsystem,budget tr zr Readandwrite(CRM acce zr


acker ssremoved) zr


HRcoordinator
zr M.Singh HRportal,payroll system zr Readandwrite
Security Analyst
zr K. Patel zr SIEM,networklogs, firewall Readonly zr


console
IT administrator
zr T.Miller Allinternalsystems Fulladmin
Juniorsystemadmin J. Lopez
zr Domaincontroller,all intern ServerOperator zr zr z


al systems
zr (Domain Admi r zr


n
removed)
Customersupportrep R. Davis zr CRM,email serverzr Readonly zr



Customersupportrep J. Hall
zr CRM,email serverzr zr Read only (Payroll syste
zr z r zr


maccess removed) j




messages.downloaded_by