mediumMultiple ChoiceObjective-mapped
CISSP Practice Question: A security architect is designing a system that…
A security architect is designing a system that must enforce the principle of least privilege at the operating system level. Which mechanism should be implemented to grant processes only the minimal permissions required for their tasks?
⚠ Common exam trap
Many exam-takers confuse RBAC with process-level least privilege, but RBAC is user-centric and does not constrain process permissions at the OS kernel level like MAC does.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Mandatory Access Control (MAC) using SELinux policies
SELinux implements Mandatory Access Control (MAC) by enforcing a system-wide security policy that overrides user and process permissions. This allows the security architect to define precise rules (e.g., via Type Enforcement) that grant each process only the minimal set of resources it needs, effectively enforcing least privilege at the OS level regardless of user identity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Mandatory Access Control (MAC) using SELinux policies
Why this is correct
Mandatory Access Control (MAC), as implemented by SELinux policies, is the most effective model for enforcing strict, system-wide security policies that cannot be overridden by users or applications. SELinux assigns security contexts to all system resources and processes, defining precisely what each process is permitted to do, regardless of user identity or traditional Unix permissions. This granular, kernel-level enforcement ensures strict confinement and adherence to the principle of least privilege, preventing unauthorized actions even if a process is compromised.
- ✗
Role-Based Access Control (RBAC) with fine-grained roles
Why it's wrong here
While Role-Based Access Control (RBAC) effectively manages user permissions based on job functions, it primarily focuses on what users can do, not necessarily on strictly confining processes at a low system level. Even with fine-grained roles, RBAC typically operates above the kernel, relying on applications or operating system services to enforce permissions. It may not provide the same level of mandatory, immutable control over process interactions with system resources that is required for enforcing least privilege across the entire system.
- ✗
Discretionary Access Control (DAC) with user permissions
Why it's wrong here
Discretionary Access Control (DAC), exemplified by traditional Unix permissions, allows resource owners to define and modify access controls for their own files and directories. This discretionary nature means that users can grant permissions to others, potentially leading to privilege escalation or unintended access, directly violating the principle of least privilege. It lacks the centralized, unalterable policy enforcement necessary for a robust, system-wide security architecture designed to confine processes and prevent arbitrary access.
- ✗
Mandatory Integrity Control (Biba)
Why it's wrong here
The Biba integrity model is designed to prevent data corruption by ensuring that information flows only from lower integrity levels to higher integrity levels ("no write down") and that subjects at a lower integrity level cannot read data at a higher integrity level ("no read up"). While crucial for data integrity, Biba's primary focus is not on enforcing the principle of least privilege for process execution or limiting what a process can do in terms of general resource access. It doesn't directly address the confinement of processes to only their necessary functions.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security policy
A security policy is a formal set of rules and guidelines that an organization establishes to protect its information assets and technology resources.
Key term
MAC
MAC (Media Access Control) is a unique hardware identifier assigned to network interfaces for communication on a local network segment.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.