Quiz
Access Control / Security
This quiz has question types that open in the usual player.
Questions in this quiz (76)
1By granting authorization to specific members of the HR department, you can reduce the chance of unauthorized access to personal identifying information (PII).
To satisfy the requirement to restrict access to PII, you can implement [blank_start]role-based access control (RBAC)[blank_end]- Arole-based access control
2[blank_start]RBAC[blank_end] is an access-control model that organizes users into roles and assigns permissions to each role as appropriate.
- Arole-based access control
3[blank_start]Authentication[blank_end] confirms the identity of the user by validating login credentials such as the user name and password. In Pega Platform, the operator ID record contains information needed to [...] a user.
[blank_start]Authorization[blank_end] determines the applications that the users can access, including actions that the user can perform and information that the user can view. In Pega Platform, the access group record lists any [...] applications and roles assigned to members of the access group.- AAuthentication
- BAuthorization
4[blank_start]Access group[blank_end] – Identifies the application, default portal, and assigned access roles for a group of users
- AAccess group
5[blank_start]Role[blank_end] – Maintains a list of all access records associated with a role
- ARole
6[blank_start]Access Deny[blank_end] – Restricts users access under certain conditions
- AAccess Deny
7[blank_start]Access of Role to Object (ARO)[blank_end] – Specifies permissions that are granted to a role and access class
- AAccess of Role to Object
8[blank_start]Class[blank_end] – Defines collections of objects that are available to other classes or to instances of the class
- AClass
9[blank_start]Privilege[blank_end] – Associates an access role with a rule that needs to be secured
- APrivilege
10[blank_start]Rule[blank_end] – Defines the behaviour of an application by serving as the building block
- ARule
11[blank_start]Class[blank_end] – Defines collections of objects that are available to other classes or to instances of the class
[blank_start]Role[blank_end] – Maintains a list of all access records associated with a role
[blank_start]Access Deny[blank_end] – Restricts users access under certain conditions
[blank_start]Access group[blank_end] – Identifies the application, default portal, and assigned access roles for a group of users
[blank_start]Access of Role to Object (ARO)[blank_end] – Specifies permissions that are granted to a role and access class
[blank_start]Rule[blank_end] – Defines the behaviour of an application by serving as the building block
[blank_start]Privilege[blank_end] – Associates an access role with a rule that needs to be secured- AClass
- BRuleset
- CRole
- DAccess List
- EAccess group
- FPortal Rule
- GAccess of Role to Object (ARO)
- HRule-based access control
- IAccess Deny
- JAccess When
- KRule
- LRuleset version
- MPrivilege
- NRole Link
12If an ARO and an access deny record are defined for the same combination of role and class, the settings on the ARO override the settings on the Access Deny record.
- ATrue
- BFalse
13In certain situations, regulations and policies require explicit denial of access to specific capabilities. You use an [blank_start]Access Deny[blank_end] record to explicitly [blank_start]deny access[blank_end] to an action for instances of a [blank_start]class[blank_end].
- AAccess Deny
- Bdeny access
- Cclass
14An [blank_start]Access Group[blank_end] record is the starting point for the RBAC access control model.
- AAccess Group
15An Access Group record is the starting point for the [blank_start]RBAC[blank_end] access control model.
- Arole-based
16Each access group references one or more [blank_start]Access Role Name[blank_end] records
- AAccess Role Name
17An [blank_start]access role name[blank_end] record identifies the name of an access role, and [blank_start]aggregates[blank_end] all of the [blank_start]individual[blank_end] [blank_start]access of role to object[blank_end] and [blank_start]access deny records[blank_end] for that role. [blank_start]No[blank_end] access control configuration occurs on the access role name record itself.
- Aaccess role name
- Baggregates
- Cindividual
- Daccess of role to object
- Eaccess deny records
- FNo
- GAll
18The foundation of the RBAC model is the [blank_start]Access of Role to Object (ARO)[blank_end] record.
- AAccess of Role to Object
19The foundation of the [blank_start]RBAC[blank_end] model is the Access of Role to Object (ARO) record.
- Arole-based access control
20You use an [blank_start]ARO[blank_end] record to define the access control settings for instances of a [blank_start]specific class[blank_end]. Each [blank_start]ARO[blank_end] identifies the actions that a role can perform on instances of the [blank_start]specified class[blank_end].
- AARO
- Bspecific class
- CARO
- Dspecified class
21Each [blank_start]ARO[blank_end] corresponds to a unique combination of [blank_start]access role[blank_end] and [blank_start]class[blank_end] which allows Pega Platform to apply permissions configured in the [blank_start]ARO[blank_end] to the users in a particular role.
- AARO
- Baccess role
- Cclass
- DARO
22What is the role of privileges in role-based access control?
- APrivileges are used to authenticate users.
- BPrivilege are used to grant application access by channel, such as web and mobile.
- CPrivileges are used to determine whether users can use a specific rule.
- DPrivileges are used to control core operations such as creating, deleting, or updating cases.
23A [blank_start]Privilege[blank_end] record is used to control access to a specific rule. Most rules list any required [...] on the Security tab of the rule form.
- APrivilege
24A [blank_start]privilege[blank_end] record acts as a token. If a rule requires a [...] to run, only users granted the [...] can run the rule. To grant a [...] to a role, add the [...] record to the appropriate [blank_start]ARO[blank_end].
- Aprivilege
- BARO
25Privileges are considered during the rule resolution process, before a candidate rule has been added to the rules cache. If users attempt to run a rule without a required privilege, the application returns an error rather than attempting to run a different version of the rule.
- ATrue
- BFalse
26Permissions that are configured in a class are inherited by child classes.
- ATrue
- BFalse
27Each application-specific role inherits permissions from a standard access role provided as part of core Pega Platform functionality. The standard access role from which permissions are inherited is called a [blank_start]dependent[blank_end] role.
- Adependent
28[blank_start]PegaRULES:SysAdm4[blank_end] Developer with full capabilities
[blank_start]PegaRULES:User1[blank_end] Application user with limited capabilities and may not perform assignments on worklists other than own worklist
[blank_start]PegaRULES:User4[blank_end] Users with broader capabilities may open any work object in the application but perform assignments only on their worklists.
[blank_start]PegaRULES:WorkMgr4[blank_end] Work manager will full capabilities that can view and update delegated rules
[blank_start]PegaRULES:Guest[blank_end] Unauthenticated access with minimum access
[blank_start]PegaRULES:Guest-Maximum[blank_end] Unauthenticated access with more capabilities, including the ability to open and update work items assigned to self
[blank_start]PegaRULES:Batch[blank_end] For background requestors, including agents
[blank_start]PegaRULES:AutoTest[blank_end] Access to Automated Unit Testing
[blank_start]PegaRULES:SysArch4[blank_end] For a business analyst or system architect who defines processes, classes, and properties and who may develop activities
[blank_start]PegaRULES:ProArch4[blank_end] For a process architect who focuses on flows and other rules in the Process and User Interface categories
[blank_start]PegaRULES:EditorCollaborator[blank_end] For collaborators that participate in the development of the application as editors. Can view and change application assets
[blank_start]PegaRULES:ViewerCollaborator[blank_end] For collaborators that participate in the development of the application as reviewers. Can view application assets but cannot change them
[blank_start]PegaRULES:PegaAPI[blank_end] Must be explicitly added to a user's access group in order to use the Pega API- APegaRULES:SysAdm4
- BPegaRULES:User1
- CPegaRULES:User4
- DPegaRULES:WorkMgr4
- EPegaRULES:Guest
- FPegaRULES:Guest-Maximum
- GPegaRULES:Batch
- HPegaRULES:AutoTest
- IPegaRULES:SysArch4
- JPegaRULES:ProArch4
- KPegaRULES:EditorCollaborator
- LPegaRULES:ViewerCollaborator
- MPegaRULES:PegaAPI
29Permissions configured on an [blank_start]Access Role Name[blank_end] record override any permissions configured for all dependent roles.
- AAccess Role Name
30If permissions for a class vary between dependent roles, the access role name inherits the most [blank_start]permissive[blank_end] permission settings.
- Apermissive
31To customize a small number of classes for an access role, customize the [blank_start]Access Role to Object[blank_end] records at the appropriate class level in your application's hierarchy.
- AAccess Role to Object
32Configuring an [blank_start]ARO[blank_end] at the application level overrides the corresponding [...] for the dependent role, and any change to the [...] for the dependent role is ignored.
- AARO
33When configuring an access role, determine the [blank_start]actions[blank_end] and [blank_start]classes[blank_end] for which you need to customize permissions.
- Aactions
- Bclasses
34If you need to customize any permissions, customize the [blank_start]ARO[blank_end] record at the appropriate [blank_start]class[blank_end] level.
- AARO
- Bclass
35Service Agents at a marina belong to two access groups that inherit permissions from different dependent roles: Service Agents inherit permissions from the PegaRULES: User1, and Service Managers inherit from PegaRULES: WorkMgr4.
Application requirements state that Service Agents and Managers can view data in Marina-Service-Data-Painting and Marina-Service-Data-Repair. Only the Service Managers can delete data from Marina-Service-Data-Painting and Marina-Service-Data-Repair.
What is the best approach to implement this requirement?- AConfigure an Access of Role to Object (ARO) record in Marina-Service-Data- class to include the Service Manager's delete permissions.
- BConfigure a Privilege record for the delete feature in both Marina-Service-Data-Painting and Marina-Service-Data-Repair and reference the Service Manager user role.
- CConfigure the Access of Role to Object (ARO) records on both Marina-Service-Data-Painting and Marina-Service-Data-Repair to include Service Manager's delete permissions.
- DConfigure an Access Deny record for the delete feature in both Marina-Service-Data-Painting and Marina-Service-Data-Repair and reference the Service Agent user role.
36[blank_start]Attachment categories[blank_end] incorporate a [blank_start]security[blank_end] component. This component allows a developer to manage access to [1] at the [1] level; for example, allowing one group of users to access an accident report, and a different set of users to access a repair estimate.
- AAttachment categories
- Bsecurity
37Attachment categories allow developers to manage access to the attached content. You apply a [...] or [...] to an attachment category to allow or deny attachment actions to users.
- APrivilege
- BWhen condition
- CRole
- DAccess Deny
38If you use a privilege or When rule to control access to a category, deselecting an action is ___________ to deny access to the action.
- Asufficient
- Bnot sufficient
39In a job application case, applicants must attach their resume as a PDF. Individuals in the human resources (HR) department and members of the interview team can view only the resume file. Which three configurations do you use in combination to achieve this? (Choose Three)
- ACreate a Resume attachment category.
- BIdentify the work group for the interview team.
- CEnable attachment-level security.
- DConfigure the appropriate roles with View permission.
- EAdd the IsInterviewer when rule for View permission.
40[blank_start]Attribute-based access control (ABAC)[blank_end] is used to control access to an object (case, report, property) by comparing characteristics of the object to [blank_start]attributes[blank_end] of the operator requesting access to the object.
- AAttribute-based access control
- Battributes
41Restrictions that broadly limit users are configured through [blank_start]role-based access control[blank_end]. In contrast, [blank_start]attribute-based access control[blank_end] affords more granular control over row-level and column-level security based on defined user attributes. [blank_start]ABAC[blank_end] supplements and extends the security capabilities of [blank_start]RBAC[blank_end].
- Arole-based access control
- Battribute-based access control
- CABAC
- DRBAC
42Use cases that are more suited to an [blank_start]ABAC[blank_end] approach include those that redact information from users without an appropriate clearance level or allow users to perform actions only if they are assigned to a particular department.
- Aattribute-based access control
43After you configure the attributes that you intend to use, configure the [blank_start]Access Control Policy Condition[blank_end] rule form. In this form, you define a set of filters and add logic that combines conditions for the access control policy.
- AAccess Control Policy Condition
44In the [blank_start]Access Control Policy Condition[blank_end] rule form, you can enter [blank_start]multiple sets of conditions[blank_end] with filter logic values. Each filter logic specification is associated with an [blank_start]Access When[blank_end] rule. Each set of filters compares a [blank_start]case attribute (property value)[blank_end] to any [blank_start]clipboard property value[blank_end] at runtime that you want. This comparison value typically represents information about the user attempting to access the protected object.
- AAccess Control Policy Condition
- Bmultiple sets of conditions
- CAccess When
- Dcase attribute (property value)
- Eclipboard property value
45After you configure the [blank_start]Access Control Policy Condition[blank_end] rule form, configure an [blank_start]Access Control Policy[blank_end] rule form.
- AAccess Control Policy Condition
- BAccess Control Policy
46In the [blank_start]Access Control Policy rule form[blank_end], you choose from one of the following actions that limit what the user is allowed to do when accessing an object:
[blank_start]Read[blank_end]: The user can open a case that meets the policy conditions or view data for the case in lists, reports, searches, and so on.
[blank_start]Update[blank_end]: The user can create a case that meets the policy conditions or update data for a case that meets the policy conditions.
[blank_start]Discover[blank_end]: The user can see limited information (defined by a developer) about a case that does not meet Read policy conditions, but does satisfy the Discover policy conditions.
[blank_start]Delete[blank_end]: The user can delete a case that meets the policy conditions.
[blank_start]PropertyRead[blank_end]: The user has restricted visibility to property values, including property values with read and update access.- AAccess Control Policy rule form
- BRead
- CUpdate
- DDiscover
- EDelete
- FPropertyRead
- GOpen
- HCreate
- IRemove
- JPropertyValue
47You can define access control policies for only the [blank_start]Work[blank_end]-, [blank_start]Index[blank_end]-, [blank_start]Data[blank_end]-, and [blank_start]Assign[blank_end]- classes in the Pega Platform database, and access control policies can inherit from [blank_start]multiple classes[blank_end].
- AWork
- BIndex
- CData
- DAssign
- Emultiple classes
48If an [blank_start]ABAC[blank_end] policy grants access, [blank_start]RBAC[blank_end] also applies and [blank_start]must[blank_end] also grant access.
- AABAC
- BRBAC
- Cmust
49The policy conditions combine from all relevant policies and allow access [blank_start]only when all policy conditions[blank_end] are satisfied. Unlike [blank_start]RBAC[blank_end], [blank_start]ABAC[blank_end] policies leverage the inheritance functionality built into Pega Platform.
- Awhen all of them
- Bwhen one of them
- Cwhen more than half of them
- DRBAC
- EABAC
- FABAC
- GRBAC
50If an [blank_start]ABAC[blank_end] policy grants access, [blank_start]RBAC[blank_end] also applies and must also grant access.
- AABAC
- BRBAC
51You can use three data types to represent an attribute in ABAC: a [blank_start]single string value[blank_end], a [blank_start]list of string values[blank_end], and a [blank_start]numerical value[blank_end].
- Asingle string value
- Blist of string values
- Cnumerical value
52In ABAC, you can evaluate a comma-separated list of string values using the special comparison operators [blank_start]All of[blank_end] and [blank_start]One of[blank_end].
- AAll of
- BOne of
53Which of the following two statements about Attribute-based access control (ABAC) are true? (Choose Two)
- AABAC allows you to control access based on a user's membership in access groups.
- BABAC control access to objects by comparing attributes assigned to users and an objects.
- COnce you disable ABAC, you cannot re-enable it and must use Role-based attribute control (RBAC).
- DABAC can leverage inheritance.
54[blank_start]Client-based access control[blank_end] provides developers with a framework that enables customers to view, modify, and erase their own personally identifiable information (PII) within a repository.
- AClient-based access control
55Client-based access control provides developers with a framework that enables customers to [blank_start]view[blank_end], [blank_start]modify[blank_end], and [blank_start]erase[blank_end] their own personally identifiable information (PII) within a repository.
- Aview
- Bmodify
- Cerase
56[blank_start]CBAC[blank_end] is used as a means of implementing the requirements under the European Union's General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), and other similar data privacy laws.
- AClient-based access control
57Client-based access control allows a Customer or User to modify and erase all of their data.
- ATrue
- BFalse
58CBAC in Pega Platform involves a Pega GDPR [blank_start]request management application[blank_end] and one or more Pega Platform applications.
- Arequest management application
59The [blank_start]RMA[blank_end] is where client rights are displayed, and the [blank_start]CBAC[blank_end] requests originate. The client interacts with the [...], and the [...] interacts with the specified repository or repositories to manage the data itself.
- Arequest management application
- Bclient-based access control
60Client requests to rectify, erase, or limit personal data usage through the RMA are made by using [blank_start]REST APIs[blank_end].
- AREST APIs
61Pega Customer Service™ provides the Pega [blank_start]GDPR/CCPA Accelerator[blank_end] application, which clients can customize to reflect their own business policies and requirements. Clients can create their own request management application by using the [...].
- AGDPR/CCPA Accelerator
62To use [blank_start]CBAC[blank_end], developers create a client-based access rule for each class where personal data is stored. For example, if personal data and identifiers are in the same class, the developer creates one [...] rule for the entire application. If personal data and identifiers are stored in multiple classes, the developer creates a [...] rule for each class.
- Aclient-based access control
63CBAC rules describe the personal data and identify where the data is stored in the Pega database. Adding a property to the CBAC policy rule enables view access for the property. Developers can add privileges to allow application users to perform the Rectify and Erase actions on the data by enabling the corresponding checkboxes.
- ATrue
- BFalse
64[blank_start]CBAC[blank_end] rules describe the personal data and identify where the data is stored in the Pega database. Adding a property to the [1] policy rule enables view access for the property. Developers can add privileges to allow application users to perform the [blank_start]Rectify[blank_end] and [blank_start]Erase[blank_end] actions on the data by enabling the corresponding checkboxes.
- Aclient-based access control
- BRectify
- CErase
65Which three actions can a developer configure in a GDPR-compliant application for customers to perform? (Choose Three)
- AAggregate data
- BRectify data
- CErase data
- DShare data
- EAccess data
66Which of the following requirements satisfy the inheritence of permissions from parent class?
- AUsers can modify cases in Work-Claims-BodilyInjury but not in Work-Claims-VehicleDamage.
- BUsers can create cases in Work-Claims-BodilyInjury but not in Work-Claims-VehicleDamage.
- CManagers can edit cases in Work-Claims-VehicleDamage but not in Work-Claims-BodilyInjury classes.
- DAuditors must have read only access to cases in the Work-Claims-VehicleDamage and Work-Claims-BodilyInjury classes.
67Which requirement do you implement with an access control policy?
- AOnly a specialized appraiser can provide an appraisal of art for a homeowner’s insurance policy.
- BOnly a customer service representative can view an unmasked account number.
- COnly a manager can authorize a refund exceeding USD1000.
- DOnly an administrator can delete a duplicate address change request.
68In a rental application, prospective tenants must attach a bank statement from the past three months. You want to ensure that members of the Rental Agency work queue can view the attachment, but no one can delete attachments.
What two configuration settings, when used in combination on the attachment category, achieve this behavior? (Choose Two)- AAdd the RentalAgencyWorkQueue privilege and select the View action.
- BAdd the RentalAgencyWorkQueue privilege and select the Edit action.
- CAdd the Always when rule and select the Delete any action.
- DAdd the Never when rule and select the Delete any action.
69You want to restrict access to a specific flow action to certain users. Which two steps must you perform? (Choose Two)
- AAdd the privilege to the flow action record.
- BAdd the privilege to the users’ access group.
- COverride the Access Deny record to the flow action.
- DAdd the privilege to a user role that is available to the users’ access group.
70Which are two principles of General Data Protection Regulation (GDPR)? (Choose Two)
- AProcess data transparently
- BMaximize personal data collection
- CShare personal data without restriction
- DEnsure data integrity and confidentiality
71Permissions configured on an Access Role Name record override any permissions configured for all dependent roles.
- ATrue
- BFalse
72You are developing a case type to facilitate online purchases where you want to encrypt the properties associated with the customer's payment information. How do you achieve this? (Choose 1)
- AYou open the database table associated with the purchase case type.
- BYou create a PropertyEncrypt access control policy.
- CYou change the property type on all relevant properties to TextEncrypt.
73You are developing a case type to facilitate online purchases where you want to encrypt the properties associated with the customer's payment information. How do you achieve this?
- AOn the purchase case type database table, you enable the option to encrypt the entire BLOB column.
- BOn the PropertyEncrypt access control policy, you list the properties associated with the customer's payment information.
74[blank_start]Data encryption[blank_end] is a process that securely encodes data and is used to protect sensitive data from [blank_start]unauthorized access[blank_end] [blank_start]within the organization and outside it[blank_end]. Data encryption is a [blank_start]two-way process[blank_end], meaning that an [blank_start]authorized user[blank_end] can decrypt encrypted data.
Data encryption uses a [blank_start]cipher[blank_end], which is the algorithm that performs the encryption and decryption, to turn readable text into an unreadable format. The [blank_start]cipher uses a key[blank_end], which is a character string, to generate a unique encryption result. Each organization uses a [blank_start]custom key to encrypt their data[blank_end] in Pega. By using custom keys, different organizations can leverage the [blank_start]same cipher[blank_end] to generate a unique encryption result.
Keys can be stored in a [blank_start]repository referred to as a keystore[blank_end]. The Pega keystore allows you to use keys created and managed by [blank_start]Amazon, Microsoft, Google, and Hashicorp[blank_end].
To encrypt data, the cipher plugs a [blank_start]unique key into its algorithm[blank_end] to generate the encrypted result.
To decrypt data, you apply the [blank_start]same key used during encryption[blank_end]. If data is stolen without the corresponding key, the data cannot be decrypted.
The two main data encryption approaches are the encryption of [blank_start]entire class instances[blank_end] and the encryption [blank_start]of specific properties[blank_end]. Consider the needs of your application and the amount of data that needs to be encrypted before selecting a data encryption approach. It might be appropriate for you to apply a [blank_start]combination[blank_end] of class-level and property-level encryption.
Class-level: Efficient method to encrypt an [blank_start]entire case or data record[blank_end] stored as a [blank_start]Binary Large Object (BLOB)[blank_end] in the database. Does not encrypt data outside of the BLOB in the database. In some cases, you want to encrypt at the class level. Class-level encryption occurs when Pega Platform [blank_start]saves a class instance[blank_end] to the database. Decryption occurs when Pega Platform retrieves and opens an instance. With class-level encryption, you encrypt the [blank_start]entire BLOB column[blank_end] for rows in the Pega Platform database that correspond to [blank_start]specific classes[blank_end].
Property-level: Encrypts properties [blank_start]in and outside the database[blank_end]. (Specifically, in the clipboard, [blank_start]logs, search indexes, and reports[blank_end].) You can encrypt properties that are optimized for reporting if the property type is [blank_start]Text[blank_end]. Can be [blank_start]time-consuming[blank_end] to individually encrypt and decrypt a large number of individual properties. In some cases, you want to encrypt individual properties. In a Tax Return case type example, in addition to encrypting the [blank_start]Tax Return object[blank_end], you decide to provide additional protection for properties that store [blank_start]uniquely identifying data[blank_end]. You encrypt the properties that store the customer's bank account number and Social Security number to protect the associated data in and outside the database. With property-level encryption, you configure a [blank_start]PropertyEncrypt[blank_end] access control policy and list the properties you want to encrypt in the [blank_start]PropertyEncrypt control policy[blank_end].- AData encryption
- Bunauthorized access
- Cwithin the organization and outside it
- Dtwo-way process
- Eauthorized user
- Fcipher
- Gcipher uses a key
- Hcustom key to encrypt their data
- Isame cipher
- Jrepository referred to as a keystore
- KAmazon, Microsoft, Google, and Hashicorp
- Lunique key into its algorithm
- Msame key used during encryption
- Nentire class instances
- Oof specific properties
- Pcombination
- Qentire case or data record
- RBinary Large Object (BLOB)
- Ssaves a class instance
- Tentire BLOB column
- Uspecific classes
- Vin and outside the database
- Wlogs, search indexes, and reports
- XText
- Ytime-consuming
- ZTax Return object
- AAuniquely identifying data
- ABPropertyEncrypt
- ACPropertyEncrypt control policy
75As a developer for an online shopping application, you decide to encrypt credit card details that customers enter in an order case type. Which data encryption approach do you choose to encrypt the data?
- AClass level
- BApplication level
- CProperty level
- DCase level
76What are two benefits of data encryption? (Choose Two)
- AData encryption provides security for data while being stored and transported.
- BData encryption reduces data storage complexity.
- CData encryption maintains data integrity.
- DData encryption improves data access time.
Information
- Description
- User has deleted their subject information Quiz on Access Control / Security, created by Deleted user on 14/09/2022.
- Author
- Deleted user
- Language
- English
- Views
- 12
- Tags