Security
What the exam tests
Security questions test the separation of authentication, authorization, and data protection. You should know how operator IDs, access groups, roles, Access of Role to Object (ARO) rules, and attribute-based policies combine.
Core rules
- Authentication proves identity (password, SSO, MFA); authorization decides permitted actions.
- An operator ID belongs to one or more access groups; an access group binds an application, roles, and default settings.
- Role-based access control uses ARO rules to grant read, write, and delete on a class, optionally guarded by an Access When condition.
- Attribute-based access control policies evaluate property values, such as region or clearance, at run time.
- Privileges gate specific actions that are not class-level, such as an administrative menu item.
- Data privacy controls protect sensitive properties; production access should follow least privilege.
Worked example
A loan application has Loan Officer and Underwriter roles. The ARO for the Loan class gives both read, but only Underwriter write. An access control policy adds: write is allowed only when LoanAmount is below 50,000 for the Junior Underwriter role. The reasoning: the role answers "what job function"; the policy answers "which records". Combining them avoids creating a separate role for every amount threshold.
Traps
Treating authentication as authorization; granting broad roles for convenience; ignoring Access When conditions; testing only with an administrator operator; leaving sensitive properties readable by every role.