mediumMultiple ChoiceObjective-mapped
CISSP Practice Question: A security architect is designing access controls…
A security architect is designing access controls for a healthcare application where permissions are based on the user's role, the sensitivity of the data, and the context of the access (e.g., time of day). Which access control model best fits this requirement?
⚠ Common exam trap
The trap here is that candidates see 'role' in the requirement and immediately choose RBAC, overlooking that the question explicitly includes data sensitivity and context (time of day), which are attributes that only ABAC can combine into a single policy decision.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attribute-Based Access Control (ABAC)
Attribute-Based Access Control (ABAC) is the correct model because it evaluates access decisions based on multiple attributes: the user's role, the data sensitivity (object attributes), and environmental context such as time of day. Unlike simpler models, ABAC can combine subject, resource, and environment attributes using policy rules (e.g., XACML or ALFA) to enforce fine-grained, context-aware permissions, which is essential for healthcare applications with dynamic compliance requirements like HIPAA.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Role-Based Access Control (RBAC)
Why it's wrong here
Role-Based Access Control (RBAC) assigns permissions based on a user's predefined organizational role, such as 'Doctor' or 'Administrator.' While effective for managing access at a broad level, RBAC inherently lacks the capability to incorporate dynamic, real-time contextual attributes like the user's current location, the time of day, or the specific sensitivity level of the data being accessed beyond what is statically assigned to the role. It relies on fixed roles and permissions, making it unsuitable for highly adaptive, context-dependent access decisions.
- ✗
Mandatory Access Control (MAC)
Why it's wrong here
Mandatory Access Control (MAC) enforces a strict, system-wide security policy by assigning sensitivity labels to all subjects and objects. Access is granted only when a subject's clearance level meets or exceeds an object's classification label, ensuring strict information flow control. This model is highly rigid and deterministic, making it incapable of incorporating dynamic environmental or user attributes to make flexible, context-dependent access decisions. MAC prioritizes data confidentiality and integrity through static, system-enforced labels, not adaptive context.
- ✓
Attribute-Based Access Control (ABAC)
Why this is correct
Attribute-Based Access Control (ABAC) is a highly flexible and dynamic authorization model that grants or denies access requests by evaluating a comprehensive set of attributes associated with the user, the resource, the environment, and the requested action. This approach allows for fine-grained access decisions that can incorporate real-time contextual information, such as the user's location, device posture, time of access, and the specific data sensitivity. By leveraging a policy engine to process these diverse attributes against defined rules, ABAC effectively supports complex, adaptive access control requirements.
- ✗
Discretionary Access Control (DAC)
Why it's wrong here
Discretionary Access Control (DAC) allows the owner of a resource to determine who can access it and what permissions they have. This decentralized model gives individual users significant control over their owned objects, enabling them to grant or revoke access at their discretion. However, DAC lacks a centralized policy enforcement mechanism and cannot easily incorporate enterprise-wide, dynamic contextual factors for access decisions, potentially leading to inconsistent security postures and making it unsuitable for complex, context-aware systems.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.