Security Fundamentals Flashcards

Which standard rule type should you add to a flow action so that only users with a named permission can run it?

Answer: Privilege

A privilege rule referenced by a rule, such as a flow action, limits access to roles that grant that privilege in an ARO.

Where is a privilege granted to an access role?

Answer: On the Privileges tab of the Access of Role to Object rule

Privileges are granted to a role on the Privileges tab of the ARO for the relevant class.

Pega finds AROs for a role on the class Work-MyCo-HR-Hire and on Work-MyCo-HR. Which one applies to a Hire case?

Answer: The ARO for the most specific class, Work-MyCo-HR-Hire

For a single role, Pega uses the ARO that matches the most specific class in the inheritance path.

What is the main difference between role-based access control (RBAC) and attribute-based access control (ABAC) in Pega?

Answer: RBAC uses access roles and AROs, and ABAC uses access control policies built on attribute conditions

RBAC grants access through roles, while ABAC uses access control policies whose conditions compare user and object attributes.

When both RBAC and ABAC are configured for a class, when does a user get Read access to an instance?

Answer: When both RBAC and ABAC grant it

Access requires both models to allow the action, so ABAC adds restrictions on top of RBAC.

Which rule type do you use to require users to authenticate through a SAML 2.0 identity provider?

Answer: Authentication service

An authentication service rule sets up the login method, such as SAML 2.0, OpenID Connect, or Kerberos.

A developer cannot check out rules even though their access group includes the right ruleset. What is the most likely cause?

Answer: The Allow rule check out option is not selected on the operator ID

The operator ID must have Allow rule check out enabled to check out rules from locked rulesets.