Information Security: Principles and Practices 2nd Edition by Jim Breithaupt, Mark S. Merkow

Exercise 21

Access control is the collection of mechanisms that permits managers of a system to exercise a directing or restraining influence over the behavior, use, and content of a system. It does not permit management to

A. specify what users can do.

B. specify which resources users can access.

C. specify how to restrain hackers.

D. specify what operations users can perform on a system.

Step 1 of 2

Access Control

Access control is used to specify what a user can or cannot do, by limiting the access to devices and resources. Thus, limiting the resources is a part of access control. As we control all access grants to a user, hence we also control what user can perform on a system, for example we can restrict user from installing new software, or accessing external devices attached to the system.

Hence the only thing which we cannot control by Access control is to restrain Hackers.

Hacker is someone who will try to breach the access controls, to gain access to information or resources.

Hence, the correct option is C. specify how to restrain hackers.