hardMultiple SelectObjective-mapped
CISSP Practice Question: A developer is implementing role-based access…
A developer is implementing role-based access control (RBAC). Which THREE components are essential for an RBAC system?
⚠ Common exam trap
Test-takers frequently confuse RBAC with ABAC and incorrectly select 'Attributes' as essential, forgetting that RBAC is role-centric, not attribute-centric, and that sessions are an optional administrative feature, not a core component.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Permissions
Permissions are essential in RBAC because they define the actual access rights (e.g., read, write, execute) that are assigned to roles, not directly to users. Without permissions, roles would have no functional authority, and the RBAC model (as defined in NIST SP 800-53 and ANSI INCITS 359) would be unable to enforce any access control decisions. Permissions are the bridge between roles and resources, making them a core component.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Permissions
Why this is correct
In Role-Based Access Control (RBAC), permissions are the atomic units of authorization, specifying precisely what actions can be performed on specific resources (e.g., "read file X", "execute program Y"). They form the fundamental building blocks of access control decisions, defining the granular rights that are then aggregated and assigned to roles, rather than directly to individual users.
- ✗
Attributes
Why it's wrong here
Attributes are characteristics or properties associated with subjects (users), objects (resources), actions, or environmental conditions. While central to Attribute-Based Access Control (ABAC) for dynamic, context-aware authorization, they are not a foundational or core component of traditional Role-Based Access Control (RBAC), which primarily relies on static assignments of users to roles and roles to permissions.
- ✓
Users
Why this is correct
Users represent the human or system entities (subjects) that require access to resources within the system. In the RBAC model, users are not directly granted permissions; instead, they are assigned one or more roles, thereby inheriting the cumulative access rights associated with those roles. This simplifies user management and streamlines access provisioning.
- ✓
Roles
Why this is correct
Roles are logical groupings of permissions that describe a specific job function, responsibility, or authority level within an organization (e.g., "Data Entry Clerk," "System Administrator," "Auditor"). They serve as an essential intermediary layer between users and permissions, enabling efficient management of access rights by assigning users to roles rather than individual permissions.
- ✗
Sessions
Why it's wrong here
A session in an access control context typically refers to a temporary, active association between a user and the system, during which access decisions are enforced. While advanced RBAC implementations or dynamic authorization systems might leverage sessions for features like runtime privilege activation or separation of duty, sessions are not a fundamental or mandatory component for the core definition and implementation of RBAC itself.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Secure Network Architecture and Components
Key term
RBAC
RBAC is a method of restricting network access based on the roles of individual users within an organization, where permissions are assigned to roles rather than to individuals directly.
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.