AP Cybersecurity
AP Cybersecurity / All lessons / Unit 5: Securing Applications and Data
5Unit 5: Securing Applications and Data
AP Cybersecurity topic 5.2

Protecting Applications and Data: Managerial Controls and Access Controls

Organizations classify data (public, internal, confidential) and set rules for each level. Access control decides who can do what. Role-based access control (RBAC) gives permissions to roles like "teacher" or "student" instead of to each person. Least privilege and separation of duties limit the damage any one account can do.

Protecting Applications and Data: Managerial Controls and Access Controls vocabulary

  • Data classification: Labeling data by how sensitive it is.
  • RBAC: Role-based access control: permissions tied to job roles.
  • Separation of duties: Splitting critical tasks so no one person can complete them alone.
  • Authorization: Deciding what an authenticated user is allowed to do.

AP-style practice questions

Try each one, then open the answer. To save your progress, take this quiz in the interactive course.

Skill: Mitigate Risk 
Email from the principal:
"Teachers should be able to edit grades only for the classes they
teach. Counselors should see grades for every student but never
change them. Students should see only their own grades."

1. Which access control model best fits this request?

  1. (A) Discretionary access control (DAC)
  2. (B) Role-based access control (RBAC)
  3. (C) Mandatory access control (MAC)
  4. (D) No access control
Show answer

(B) Role-based access control (RBAC) Permissions are tied to roles: teacher, counselor, and student.

Skill: Mitigate Risk 
$ ls -l lesson_plans.docx
-rw-r--r--  mpark  teachers  4096  Oct 3 08:12  lesson_plans.docx

2. The owner (mpark) wants to keep full read and write access, let the teachers group read the file, and give everyone else no access. Which command does this?

  1. (A) chmod 644 lesson_plans.docx
  2. (B) chmod 640 lesson_plans.docx
  3. (C) chmod 777 lesson_plans.docx
  4. (D) chmod 600 lesson_plans.docx
Show answer

(B) chmod 640 lesson_plans.docx In octal, 6 = read + write for the owner, 4 = read for the group, and 0 = nothing for others.

Skill: Mitigate Risk

3. A company labels files as Public, Internal, Confidential, and Restricted. Which of the following best explains why?

  1. (A) So each level gets protection that matches its sensitivity
  2. (B) So files sort alphabetically
  3. (C) So all files get the same protection
  4. (D) So employees can delete files faster
Show answer

(A) So each level gets protection that matches its sensitivity Data classification lets an organization apply stronger controls to more sensitive data.

Skill: Mitigate Risk

4. A government agency assigns every document a clearance level, and users cannot change who may read a document. Which access control model is this?

  1. (A) DAC
  2. (B) MAC
  3. (C) RBAC
  4. (D) Rule-based access control
Show answer

(B) MAC In mandatory access control, the system enforces labels and owners cannot override them.

Open 5.2 in the interactive course