The answer is that permissions are assigned to roles, not individual users. This is the defining characteristic of Role-Based Access Control (RBAC), because RBAC groups permissions into roles based on job functions, and users are then assigned to those roles. When a user is added to a role, they automatically inherit all permissions associated with that role, which simplifies administration and ensures consistent access rights across an organization. On the ISC2 Certified in Cybersecurity CC exam, this concept tests your understanding of how RBAC streamlines access management versus discretionary or mandatory controls; a common trap is confusing role assignment with direct permission assignment to users. Remember the memory tip: “Users get roles, roles get rights”—if you see an answer saying permissions are given directly to users, it is not RBAC.
ISC2 CC Access Controls Concepts Practice Question
This CC practice question tests your understanding of access controls concepts. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Which TWO are characteristics of Role-Based Access Control (RBAC)?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Users are assigned to roles, and inherit permissions from those roles.
Option A is correct because RBAC defines roles that group specific permissions, and users are assigned to these roles. When a user is added to a role, they automatically inherit all permissions associated with that role, simplifying administration and ensuring consistent access rights across the organization.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Users are assigned to roles, and inherit permissions from those roles.
Why this is correct
Role assignment is fundamental to RBAC.
Related concept
Read the scenario before looking for a memorised answer.
✗
Object owners can delegate permissions to others.
Why it's wrong here
Owner delegation is characteristic of DAC, not RBAC.
✗
Access decisions are based on security labels.
Why it's wrong here
Labels are used in MAC, not RBAC.
✗
It enforces a centralized policy that cannot be overridden by users.
Why it's wrong here
That describes MAC, not RBAC.
✓
Permissions are assigned to roles, not individual users.
Why this is correct
RBAC groups permissions into roles.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
ISC2 often tests the distinction between RBAC and DAC by presenting delegation of permissions (Option B) as a plausible RBAC feature, when in fact it belongs to DAC.
Detailed technical explanation
How to think about this question
Under the hood, RBAC relies on role hierarchies and role-permission assignments defined in standards like NIST SP 800-53 or RFC 2904. A real-world scenario is in Cisco ISE, where RBAC is used to define network access policies: an administrator creates roles like 'NetworkAdmin' with permissions to configure switches, and users assigned to that role inherit those permissions without needing individual configuration. A subtle behavior is that RBAC can support separation of duties by enforcing mutually exclusive roles, preventing a single user from holding conflicting permissions.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A security analyst at a medium-sized enterprise encounters this scenario during an investigation or architecture review. The correct answer reflects best practice for the specific threat or control described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Security exam questions test whether you can match controls to threats in context — not just recall definitions.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this CC question in full detail.
Access Controls Concepts — This question tests Access Controls Concepts — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Users are assigned to roles, and inherit permissions from those roles. — Option A is correct because RBAC defines roles that group specific permissions, and users are assigned to these roles. When a user is added to a role, they automatically inherit all permissions associated with that role, simplifying administration and ensuring consistent access rights across the organization.
What should I do if I get this CC question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An organization implements an access control system where users are assigned to groups, and permissions are granted to groups rather than individuals. This is known as:
easy
A.Mandatory Access Control (MAC)
✓ B.Role-Based Access Control (RBAC)
C.Discretionary Access Control (DAC)
D.Attribute-Based Access Control (ABAC)
Why B: Role-Based Access Control (RBAC) assigns permissions to roles (or groups) rather than to individual users. Users are then made members of these roles, inheriting the permissions associated with the role. This matches the description in the question, where users are assigned to groups and permissions are granted to those groups.
Last reviewed: Jun 30, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.