WGU C845 VUN1 Task 1 | Passed on First
Attempt |Latest Update with Complete Solution
VUN1 — VUN1 Task 1: Managing Security Operations and Access Controls
Information Systems Security - C845
A. Apply an Access Control Model
A.1. Chosen Access Control Model
I have chosen the Role-Based Access Control (RBAC) model. The principles of RBAC are:
• Role Assignment: A user is assigned to a role based on their job function (e.g., "Finance
Analyst").
• Permission Assignment: Permissions to perform operations on systems are assigned to roles,
not to individual users.
• Session Management: A user activates a role to gain the associated permissions for a session.
• Least Privilege: Users should only have the minimum level of access necessary to perform their
job duties.
The organization's access control structure, as seen in the user matrix, is implicitly role-based (e.g.,
"Finance manager," "HR coordinator"). Applying a formal RBAC model would streamline this by ensuring
permissions are strictly tied to business functions, reducing complexity and the potential for user error
when assigning permissions.
A.2. Four Misalignments with RBAC Principles
1. Misalignment 1: Privilege Escalation Beyond Role Scope
• Description: The "Junior system admin" (J. Lopez) has "Domain admin" privileges. A
junior role should not have the highest level of access in a Windows environment.
• Conflict with RBAC: This violates the principle of least privilege. The role "Junior system
admin" implies a subset of administrative duties, not unrestricted domain-wide control.
2. Misalignment 2: Unnecessary Access Across Departments
• Description: The "Finance analyst" (L. Cheng) has "Full access" to the CRM, a system
Downloaded by Great Mind ()
, primarily for Sales and Support. A finance role typically does not require full modification
rights in a customer relationship system.
• Conflict with RBAC: This violates least privilege and separation of duties. It allows for
potential data manipulation outside the user's core business function.
3. Misalignment 3: Violation of User-Role Assignment Post-Termination
• Description: The "HR assistant" (P. Ellis), who was terminated on 2025-05-20, has an
"Active" account status and successfully logged in on 2025-06-29.
• Conflict with RBAC: RBAC requires timely revocation of role assignments upon a change
in employment status. An active session for a terminated user completely bypasses the
security provided by the role structure.
4. Misalignment 4: Overly Broad Privileged Access
• Description: The "IT administrator" (T. Miller) has "Full admin" access to "All internal
systems," and the log shows they made a firewall rule change without a ticket_id.
• Conflict with RBAC: While some access is necessary, blanket "Full admin" access
violates least privilege and impedes accountability. It does not segment duties within the
IT department itself.
Downloaded by Great Mind ()
, A.3. Recommended Changes to Resolve Misalignments i i i i i i
1. Recommendation1:Implement PrivilegeTieringforAdministrativeRoles i i
• Justification: Following the CIS Control 5 (Account Management) and t
i i ii i i i i i i i i i i i i ii
he principle of
ii i i
least privilege,administrativeaccountsshouldbesegregated.The"Juniorsystemadmin"
j ii
role should be assigned amorerestricted setofprivileges, such as "Server Operator
ii ii i i i i ii ii ii ii ii
" or "Help Desk Administrator," which allows for daily tasks without granting domai
ii i i ii ii ii ii ii ii ii ii ii ii
n-wide control (NIST SP 800-53, AC-6).
i i i i i i i i i i
2. Recommendation2:Conduct aRole-PermissionReview andRemediation j
• Justification: Align with ISO/IEC 27001:2022, A.5.35 i i
(Access control) by performing a formal i i i i ii
reviewofall role assignments.Remove accessto systemslikethe ii
CRM from
the "Financeanalyst"roleunlessacompellingbusinessjustificationexists. ii
Accessshouldbe based on documented job requirements. ii i i i i i i i i
3. Recommendation3:AutomateAccessRevocationandEnforceChangeManagement
• Justification:PerNISTSP800-53,AC-
2(AccountManagement),accountrevocationmust occur immediately upon terminati ii i i i i i i
on. This should be an automated part of the HR offboarding process. Further
i i i i i i i i i i i i i i i i ii i i i i i i
more, all changes, including firewall modifications, must require aticket IDfor app
i i i i i i i i ii i i i i i ii i ii
rovaland auditing (CIS Control10- MalwareDefenses, relying on change management).
i i i ii i i ii i ii ii i i ii
A.4. Revised User Role Matrix ii ii ii
TherevisedmatrixreflectsastricterRBACimplementation.Keychangesare bolded.
Role Assigned User ii SystemAccess PrivilegeLevel(Revised)
Finance Manager
ii A. Jones ii Payrollsystem,budget tr ii Fullaccess
acker
Financeanalyst L.Cheng i Payrollsystem,budget tr ii Readandwrite(CRM acce ii
acker ssremoved) i
HRcoordinator
i M.Singh HRportal,payroll system ii Readandwrite
Security Analyst
ii K.Patel i SIEM,networklogs, firewall Readonly ii
console
ITadministrator
i T.Miller Allinternalsystems Fulladmin
Juniorsystemadmin J.Lopez
i Domaincontroller,all intern ServerOperator ii i ii
al systems ii (Domain Admi ii
n
removed)
Customersupportrep R.Davis i CRM,emailserver i Readonly i
Customersupportrep J.Halli CRM,emailserver i i Read only (Payroll system
ii i i ii
access removed) j
Externalauditor D.Nguyen Budgettracker Readonly
DownloadediibyiiGreatiiMindii()
Attempt |Latest Update with Complete Solution
VUN1 — VUN1 Task 1: Managing Security Operations and Access Controls
Information Systems Security - C845
A. Apply an Access Control Model
A.1. Chosen Access Control Model
I have chosen the Role-Based Access Control (RBAC) model. The principles of RBAC are:
• Role Assignment: A user is assigned to a role based on their job function (e.g., "Finance
Analyst").
• Permission Assignment: Permissions to perform operations on systems are assigned to roles,
not to individual users.
• Session Management: A user activates a role to gain the associated permissions for a session.
• Least Privilege: Users should only have the minimum level of access necessary to perform their
job duties.
The organization's access control structure, as seen in the user matrix, is implicitly role-based (e.g.,
"Finance manager," "HR coordinator"). Applying a formal RBAC model would streamline this by ensuring
permissions are strictly tied to business functions, reducing complexity and the potential for user error
when assigning permissions.
A.2. Four Misalignments with RBAC Principles
1. Misalignment 1: Privilege Escalation Beyond Role Scope
• Description: The "Junior system admin" (J. Lopez) has "Domain admin" privileges. A
junior role should not have the highest level of access in a Windows environment.
• Conflict with RBAC: This violates the principle of least privilege. The role "Junior system
admin" implies a subset of administrative duties, not unrestricted domain-wide control.
2. Misalignment 2: Unnecessary Access Across Departments
• Description: The "Finance analyst" (L. Cheng) has "Full access" to the CRM, a system
Downloaded by Great Mind ()
, primarily for Sales and Support. A finance role typically does not require full modification
rights in a customer relationship system.
• Conflict with RBAC: This violates least privilege and separation of duties. It allows for
potential data manipulation outside the user's core business function.
3. Misalignment 3: Violation of User-Role Assignment Post-Termination
• Description: The "HR assistant" (P. Ellis), who was terminated on 2025-05-20, has an
"Active" account status and successfully logged in on 2025-06-29.
• Conflict with RBAC: RBAC requires timely revocation of role assignments upon a change
in employment status. An active session for a terminated user completely bypasses the
security provided by the role structure.
4. Misalignment 4: Overly Broad Privileged Access
• Description: The "IT administrator" (T. Miller) has "Full admin" access to "All internal
systems," and the log shows they made a firewall rule change without a ticket_id.
• Conflict with RBAC: While some access is necessary, blanket "Full admin" access
violates least privilege and impedes accountability. It does not segment duties within the
IT department itself.
Downloaded by Great Mind ()
, A.3. Recommended Changes to Resolve Misalignments i i i i i i
1. Recommendation1:Implement PrivilegeTieringforAdministrativeRoles i i
• Justification: Following the CIS Control 5 (Account Management) and t
i i ii i i i i i i i i i i i i ii
he principle of
ii i i
least privilege,administrativeaccountsshouldbesegregated.The"Juniorsystemadmin"
j ii
role should be assigned amorerestricted setofprivileges, such as "Server Operator
ii ii i i i i ii ii ii ii ii
" or "Help Desk Administrator," which allows for daily tasks without granting domai
ii i i ii ii ii ii ii ii ii ii ii ii
n-wide control (NIST SP 800-53, AC-6).
i i i i i i i i i i
2. Recommendation2:Conduct aRole-PermissionReview andRemediation j
• Justification: Align with ISO/IEC 27001:2022, A.5.35 i i
(Access control) by performing a formal i i i i ii
reviewofall role assignments.Remove accessto systemslikethe ii
CRM from
the "Financeanalyst"roleunlessacompellingbusinessjustificationexists. ii
Accessshouldbe based on documented job requirements. ii i i i i i i i i
3. Recommendation3:AutomateAccessRevocationandEnforceChangeManagement
• Justification:PerNISTSP800-53,AC-
2(AccountManagement),accountrevocationmust occur immediately upon terminati ii i i i i i i
on. This should be an automated part of the HR offboarding process. Further
i i i i i i i i i i i i i i i i ii i i i i i i
more, all changes, including firewall modifications, must require aticket IDfor app
i i i i i i i i ii i i i i i ii i ii
rovaland auditing (CIS Control10- MalwareDefenses, relying on change management).
i i i ii i i ii i ii ii i i ii
A.4. Revised User Role Matrix ii ii ii
TherevisedmatrixreflectsastricterRBACimplementation.Keychangesare bolded.
Role Assigned User ii SystemAccess PrivilegeLevel(Revised)
Finance Manager
ii A. Jones ii Payrollsystem,budget tr ii Fullaccess
acker
Financeanalyst L.Cheng i Payrollsystem,budget tr ii Readandwrite(CRM acce ii
acker ssremoved) i
HRcoordinator
i M.Singh HRportal,payroll system ii Readandwrite
Security Analyst
ii K.Patel i SIEM,networklogs, firewall Readonly ii
console
ITadministrator
i T.Miller Allinternalsystems Fulladmin
Juniorsystemadmin J.Lopez
i Domaincontroller,all intern ServerOperator ii i ii
al systems ii (Domain Admi ii
n
removed)
Customersupportrep R.Davis i CRM,emailserver i Readonly i
Customersupportrep J.Halli CRM,emailserver i i Read only (Payroll system
ii i i ii
access removed) j
Externalauditor D.Nguyen Budgettracker Readonly
DownloadediibyiiGreatiiMindii()
