mediumMultiple ChoiceObjective-mapped
CISSP Practice Question: A company uses Role-Based Access Control (RBAC)…
A company uses Role-Based Access Control (RBAC) for its ERP system. A user in the 'Accounts Payable' role needs to temporarily approve purchase orders up to $10,000 while the 'Purchasing Manager' is on leave. What is the BEST way to grant this access?
⚠ Common exam trap
It's easy for candidates to choose Option D (creating a new role) because they think it follows least privilege, but they overlook that RBAC best practice is to reuse existing roles with temporary assignments rather than proliferating roles, which violates role-mining principles and adds administrative overhead.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Temporarily assign the 'Purchasing Approver' role to the user with an expiration date
It follows the principle of least privilege by temporarily assigning the 'Purchasing Approver' role to the user with an expiration date, ensuring that the elevated permissions are automatically revoked after the leave period. This approach maintains RBAC integrity without permanently altering role definitions or sharing credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Share the Purchasing Manager's account credentials with the user
Why it's wrong here
Sharing credentials completely undermines individual accountability and non-repudiation, making it impossible to accurately audit who performed specific actions within the ERP system. This practice also significantly increases the risk of unauthorized access if the shared credentials are compromised, violating fundamental security principles, organizational policies, and potentially regulatory compliance requirements.
- ✓
Temporarily assign the 'Purchasing Approver' role to the user with an expiration date
Why this is correct
This is the most appropriate solution as it adheres to the principle of least privilege and just-in-time (JIT) access. By temporarily assigning an existing, appropriate role with an explicit expiration date, the user gains only the necessary permissions for the required duration, automatically revoking access once the task is complete. This minimizes the window of potential misuse and maintains strong access control governance.
- ✗
Modify the 'Accounts Payable' role to include purchase order approval permissions
Why it's wrong here
Modifying an existing, standard role like 'Accounts Payable' to include purchase order approval permissions permanently expands the privileges for all users assigned to that role, not just the individual with the temporary need. This action violates the principle of least privilege by granting unnecessary, enduring access to multiple users, increasing the attack surface and making role management less granular and more complex for future administration.
- ✗
Create a new role with the exact permissions needed and assign it to the user
Why it's wrong here
Creating a new role violates the principle of least privilege by failing to address the temporary nature of the requirement, leading to permanent permission creep. This approach is intended for defining standard job functions within an organisation's hierarchy. You would use this method when establishing a permanent position that requires a consistent set of permissions across Microsoft Entra ID or similar identity providers.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Identity and Access Management (IAM)
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
Key term
RBAC
RBAC is a method of restricting network access based on the roles of individual users within an organization, where permissions are assigned to roles rather than to individuals directly.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.