CS 7643 QUIZ 3 PREP SET UPDATED ACTUAL EXAM QUESTIONS CORRECT ANSWERS GRADED A

CS 7643 QUIZ 3 PREP SET UPDATED ACTUAL EXAM QUESTIONS CORRECT ANSWERS
GRADED A PLUS




Question:
.

Answer:
20161020 mandatory access control lecture TWO 1 of 3 different POLICIES RBAC (Role Based
Access Control) part 3 Access Control Policy --> PA and UA,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,PA
C[underline] R x P,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,UA C[underline] U x R e.g. (user, role (alice,
manager) what role does a user have in order to do what they need to do



Question:
role.

Answer:
20161020 mandatory access control lecture TWO 1 of 3 different POLICIES RBAC (Role Based
Access Control) part 4 What happens at execution time? at execution time,,,,,,user: S--> U,,,,,,role:
S--> 2^R the point is: do not limit a session to a single ________



Question:
permissios.

Answer:
20161020 mandatory access control lecture TWO 1 of 3 different POLICIES RBAC (Role Based
Access Control) part 5 What are the Permissions that a certain session S has to have?
____________(S) = U,,,,,,,,,,,,,{ P | (P,r) E (PA},,,,,,,,,,,,,,,,,,,,,,,,,,r E Roles (s) E = "belongs to" | =
"such that???" so any permission that is r that belongs to S, that is a set of resources we have access
to



Question:
basic.

,Answer:
20161020 mandatory access control lecture TWO 1 of 3 different POLICIES RBAC (Role Based
Access Control) part 6 ___________ RBAC = RBAC-0 (said RBAC zero)



Question:
groups.

Answer:
20161020 mandatory access control lecture TWO 1 of 3 different POLICIES RBAC (Role Based
Access Control) part 7 Do not talk about anything unless you talk about how you want to implement
it. DId we not see something like this before HINT: in DAC? A: _____________!!; Groups and
Roles are Related Why does this make things better?



Question:
role.

Answer:
20161020 mandatory access control lecture TWO 1 of 3 different POLICIES RBAC (Role Based
Access Control) part 8 Q: First IMPLEMENTATION? A: we already have an AUTHENTICATION
SVC. we also have an AUTHORIZATION SVC Says need "________ ACTIVATION SVC" piece
you would say activate_role(r) --> u:= user who logged in and on whose behalf caller runs Activate r
for u if (u,r) E UA Add r to the set of roles associated with U's session



Question:
roles.

Answer:
20161020 mandatory access control lecture TWO 1 of 3 different POLICIES RBAC (Role Based
Access Control) part 9 _________versus GROUPS Policy & it's representation ACM --> (U,O)
*RBAC --> U xR + R x O = R ( U + O)* now we will move on the "what you should do".the
clark-Wilson policy



Question:

,.

Answer:
20161020 mandatory access control lecture TWO 2 of 3 different POLICIES CLARK-WILSON
Policy



Question:
transactions.

Answer:
20161020 mandatory access control lecture TWO 2 of 3 different POLICIES CLARK-WILSON
Policy PART 2 says we have well-formed _____________. assume that the transactions we have
correspond to some high level job function



Question:
transformation procedures.

Answer:
20161020 mandatory access control lecture TWO 2 of 3 different POLICIES CLARK-WILSON
Policy PART 3,,,,,,,,,,,,,,,,,,,,,,,, TP (or ______________ ) user 1 --> { TP1 C[underline] TP user 2
--> { TP2 C[underline] TP. user n--> { TPn C[underline] TP



Question:
sequencing.

Answer:
20161020 mandatory access control lecture TWO 2 of 3 different POLICIES CLARK-WILSON
Policy PART 4 #1 has _______________ TPi comes before TPj



Question:
then.

Answer:

, 20161020 mandatory access control lecture TWO 2 of 3 different POLICIES CLARK-WILSON
Policy PART 5 where does the sequencing idea come from? A: in the paper they have this example
that orders supplies an somebody makes a delivery, pay an invoice on delivered. Workflow we have
in a system. some diagnosis is done _______________ you pay the invoice so sequencing would say
something has to happen before something else



Question:
constrained.

Answer:
20161020 mandatory access control lecture TWO 2 of 3 different POLICIES CLARK-WILSON
Policy PART 6 #2 _____________ DATA item only certain?? can access TP1 --> CD1 C CD TP2
--> CD2 C CD.



Question:
workflow.

Answer:
20161020 mandatory access control lecture TWO 2 of 3 different POLICIES CLARK-WILSON
Policy PART 7 #3 _____________ did not write this down. he just talked about it



Question:
duty separation, issues.

Answer:
20161020 mandatory access control lecture TWO 2 of 3 different POLICIES CLARK-WILSON
Policy PART 7 #4 ____________ Once they do A they don;t have to do B What would be an
example of Separation of Duty? A: person confirmed package was rec'd, same person ___________
invoice, same person pays the invoice



Question:
.

Answer: