Courseiva
mediumMultiple ChoiceObjective-mapped

ISC2 CC Practice Question: A security architect is designing access controls…

A security architect is designing access controls for a new application. The requirement is that only managers can approve expense reports above $10,000. Which control model best fits this requirement?

⚠ Common exam trap

ISC2 often tests the distinction between RBAC and RuBAC by presenting a scenario with a conditional rule (like a dollar threshold), leading candidates to mistakenly choose RBAC because they focus on the 'manager' role rather than the rule that triggers the approval requirement.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Rule-based access control (RuBAC)

Rule-based access control (RuBAC) uses a set of rules or conditions to determine access decisions, such as the expense report amount exceeding $10,000. In this scenario, the access control decision depends on a dynamic attribute (the expense amount) rather than a static role or identity, making RuBAC the best fit. RuBAC is often implemented using access control lists (ACLs) or policy-based engines that evaluate conditions like 'if amount > 10000 then require manager approval'.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • Role-based access control (RBAC)

    Why it's wrong here

    RBAC assigns permissions based on roles, but not dynamic rules like expense amount.

  • Discretionary access control (DAC)

    Why it's wrong here

    DAC allows owners to set permissions, not rule-based on transaction attributes.

  • Mandatory access control (MAC)

    Why it's wrong here

    MAC uses labels, not transaction rules.

  • Rule-based access control (RuBAC)

    Why this is correct

    RuBAC uses rules (e.g., conditions) to determine access, matching the requirement.

Visual reference

Source Router + ACL permit 10.0.0.0/8 deny any Server 10.0.0.5 ✓ 192.168.1.1 ✗ dropped ACLs evaluate top-down; first match wins — implicit deny all at end

About these practice questions

One of 976 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.