Systems Security Certified Practitioner (SSCP) — Question 9

A department manager has read access to the salaries of the employees in his/her department but not to the salaries of employees in other departments. A database security mechanism that enforces this policy would typically be said to provide which of the following?

Answer options

• A. Content-dependent access control
• B. Context-dependent access control
• C. Least privileges access control
• D. Ownership-based access control

Correct answer: A

Explanation

The correct answer is A, Content-dependent access control, as it limits access based on the content of the data, in this case, salaries specific to a department. Options B, C, and D do not accurately describe the scenario; B refers to access based on the context or situation, C involves granting only the necessary privileges, and D relates to access based on the ownership of the data.