mediumMultiple ChoiceObjective-mapped
ISC2 CC Practice Question: A security architect is designing access controls…
A security architect is designing access controls for a new application. The requirement is that only managers can approve expense reports above $10,000. Which control model best fits this requirement?
⚠ Common exam trap
ISC2 often tests the distinction between RBAC and RuBAC by presenting a scenario with a conditional rule (like a dollar threshold), leading candidates to mistakenly choose RBAC because they focus on the 'manager' role rather than the rule that triggers the approval requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Rule-based access control (RuBAC)
Rule-based access control (RuBAC) uses a set of rules or conditions to determine access decisions, such as the expense report amount exceeding $10,000. In this scenario, the access control decision depends on a dynamic attribute (the expense amount) rather than a static role or identity, making RuBAC the best fit. RuBAC is often implemented using access control lists (ACLs) or policy-based engines that evaluate conditions like 'if amount > 10000 then require manager approval'.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Role-based access control (RBAC)
Why it's wrong here
RBAC assigns permissions based on roles, but not dynamic rules like expense amount.
- ✗
Discretionary access control (DAC)
Why it's wrong here
DAC allows owners to set permissions, not rule-based on transaction attributes.
- ✗
Mandatory access control (MAC)
Why it's wrong here
MAC uses labels, not transaction rules.
- ✓
Rule-based access control (RuBAC)
Why this is correct
RuBAC uses rules (e.g., conditions) to determine access, matching the requirement.
Visual reference
Go deeper
Related to this question
Learn chapter
Introduction to Security Principles
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
About these practice questions
One of 976 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.