mediumMultiple ChoiceObjective-mapped
CISSP Practice Question: A security administrator is configuring…
A security administrator is configuring role-based access control (RBAC) for a cloud storage system. Which of the following is the best practice for assigning permissions?
⚠ Common exam trap
A common misconception in CISSP is that ACLs are the best way to secure cloud storage because they seem granular, but the trap is that ACLs are a legacy DAC mechanism that does not scale and violates the RBAC model's centralized management principle.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create roles based on job functions and assign users to roles
Role-based access control (RBAC) is the recommended approach for managing permissions in cloud storage systems because it aligns with the principle of least privilege and simplifies administration. By creating roles based on job functions and assigning users to those roles, permissions are granted consistently and can be easily audited or modified without touching individual user accounts. This reduces the risk of excessive permissions and makes compliance with policies like separation of duties more manageable.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use access control lists on each object
Why it's wrong here
Using access control lists (ACLs) assigns permissions directly to objects for specific users or groups, which is a form of Discretionary Access Control (DAC). This approach differs from Role-Based Access Control (RBAC) because it lacks the abstraction of roles, making permission management cumbersome and difficult to scale in environments where access needs to be defined by job functions rather than individual object ownership.
- ✗
Implement mandatory access control
Why it's wrong here
Mandatory Access Control (MAC) enforces access decisions based on system-defined security labels, such as sensitivity levels and categories, assigned to subjects and objects. This model, exemplified by Bell-LaPadula, is primarily used in high-security environments and is fundamentally distinct from Role-Based Access Control (RBAC), which bases access on organizational roles and job functions rather than fixed security classifications.
- ✓
Create roles based on job functions and assign users to roles
Why this is correct
Creating roles based on job functions and then assigning users to these predefined roles is the fundamental principle of Role-Based Access Control (RBAC). This method centralizes permission management by associating specific permissions with a role, ensuring that users automatically inherit the appropriate access rights for their position. It significantly simplifies administration, enhances security by enforcing least privilege, and provides a scalable, consistent access policy across the organization.
- ✗
Assign permissions directly to users for flexibility
Why it's wrong here
Assigning permissions directly to individual users, while seemingly offering flexibility, fundamentally undermines the principles and benefits of Role-Based Access Control (RBAC). This approach leads to significant administrative overhead, as each user's permissions must be managed individually, rather than through a streamlined role. It also increases the risk of inconsistent access policies and makes auditing permissions much more complex, negating RBAC's goal of simplified, scalable management.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.