Back to Security Architecture Models

Lattice-Based Access Control Model

5 minutes 5 Questions

Lattice-Based Access Control (LBAC) Model is a security model that combines both confidentiality and integrity requirements based on a mathematical structure called a lattice. In this model, each subject and object is assigned a pair of integrity and confidentiality levels, known as a label. Access…

Test mode:
Start practice test
CISSP - Lattice-Based Access Control Model Example Questions

Test your knowledge of Lattice-Based Access Control Model

Question 1

A government agency using Lattice-Based Access Control needs to restrict employees' access to specific government documents. To establish access restrictions, which type of lattice element is most suitable?

Correct Answer: Security level

In the Lattice-Based Access Control model, security levels like 'Top Secret', 'Secret', and 'Confidential' are used to establish access restrictions. Security levels provide a mechanism to protect information based on its sensitivity.

Question 2

In an organization using Lattice-Based Access Control, User_A has a 'Secret' security level, and an object has its classification level as 'Top Secret'. Can User_A access the object?

Correct Answer: No, User_A cannot access the object

In a Lattice-Based Access Control model, a user needs to have a security level equal to or higher than the object's classification level to access it. In this case, User_A's 'Secret' security level does not dominate the object's 'Top Secret' classification level, and access is denied.

Question 3

An IT company implements a Lattice-Based Access Control model and uses a combination of clearance levels and categories. In this model, clearance levels follow an order: 'Top Secret', 'Secret', 'Confidential'. If User_X has a clearance level of 'Secret' and additional categories that the object lacks, and the object has a clearance level of 'Confidential', can User_X access the object?

Correct Answer: Yes, User_X can access the object

In a Lattice-Based Access Control model that combines clearance levels and categories, a user is granted access to an object if the user's clearance level is equal to or higher than the object's clearance level, and the user possesses all the categories that the object requires. Additional categories that the user has but the object does not have do not restrict access. In this case, User_X has a clearance level of 'Secret', which is higher than the object's 'Confidential' level. Although User_X has additional categories that the object lacks, this is permissible because the user meets or exceeds all the object's category requirements. Therefore, User_X can access the object.

More Lattice-Based Access Control Model questions
9 questions (total)
Start 9 question test