mediumMultiple ChoiceObjective-mapped
CISSP Practice Question: A hospital is implementing an access control…
A hospital is implementing an access control system for its electronic health record (EHR) application. The system must ensure that only authorized healthcare providers can access patient records based on their role (doctor, nurse, administrator), department (cardiology, oncology, etc.), and patient consent status. The hospital also needs to support break-the-glass access for emergencies. The current solution uses static role-based access control (RBAC) but fails to enforce department-level restrictions and consent checks. What is the most appropriate access control model to address these requirements?
⚠ Common exam trap
It's easy for candidates to assume RBAC can be extended with more roles to cover all requirements, but they miss that RBAC cannot dynamically evaluate multi-attribute conditions like consent status or emergency context without becoming unmanageable, whereas ABAC is designed for exactly such fine-grained, attribute-driven policies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement an attribute-based access control (ABAC) system
Attribute-based access control (ABAC) is the correct choice because it can dynamically evaluate multiple attributes—such as user role, department, patient consent status, and emergency context—to grant or deny access. Unlike static RBAC, ABAC supports fine-grained, context-aware policies that can enforce department-level restrictions and consent checks, and it can incorporate break-the-glass rules by evaluating an emergency attribute or time-based condition.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enhance the existing RBAC model with more granular roles for each department
Why it's wrong here
Enhancing an existing Role-Based Access Control (RBAC) model with more granular departmental roles still relies on static role assignments and predefined permissions. While it improves organization, RBAC fundamentally struggles with dynamic, context-dependent access decisions required in a hospital, such as evaluating real-time patient consent or implementing "break-the-glass" emergency access. It lacks the inherent flexibility to incorporate transient environmental or resource attributes into access policy evaluations.
- ✗
Use mandatory access control (MAC) with security labels per patient record
Why it's wrong here
Mandatory Access Control (MAC) enforces access based on fixed security labels assigned to subjects and objects, following a strict top-down classification policy. This model is inherently inflexible for a hospital environment, as it cannot dynamically incorporate user attributes like departmental affiliation, specific patient consent status, or the context of an emergency. Its rigid, static nature prevents the fine-grained, context-aware decisions necessary for modern healthcare access management.
- ✓
Implement an attribute-based access control (ABAC) system
Why this is correct
Implementing an Attribute-Based Access Control (ABAC) system is the most suitable solution because it evaluates access requests based on a combination of attributes related to the user (e.g., role, department), the resource (e.g., patient data sensitivity, consent status), and the environment (e.g., time of day, emergency flag). This dynamic policy evaluation capability allows ABAC to precisely enforce complex rules, such as patient-specific consent requirements and "break-the-glass" emergency access, providing unparalleled flexibility and granularity.
- ✗
Apply discretionary access control (DAC) allowing providers to set access permissions
Why it's wrong here
Applying Discretionary Access Control (DAC) would allow individual healthcare providers, as object owners, to set and modify access permissions for patient records. This decentralized approach inevitably leads to inconsistent access policies across the hospital, making it impossible to enforce a uniform security posture or ensure compliance with regulatory requirements like HIPAA. DAC lacks centralized control and auditability, posing significant risks of unauthorized data access and security vulnerabilities.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Identity and Access Management (IAM)
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
Key term
ABAC
ABAC (Attribute-Based Access Control) is a method of controlling access to resources by evaluating a set of attributes (such as user role, time, location, and device) against policy rules, rather than using static roles or identities.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.