CISSP Security Architecture and Engineering Practice Question
A security architect is evaluating access control models for a healthcare system where users have specific roles (e.g., doctor, nurse, admin) and permissions are assigned based on those roles. However, the architect also wants to incorporate attributes such as time of day, patient consent status, and device type. Which TWO models should be combined to meet these requirements?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ABAC
RBAC provides role-based permissions, while ABAC adds flexibility with attributes. Combining them allows fine-grained control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Clark-Wilson
Why it's wrong here
Clark-Wilson is fundamentally an integrity model, not an access control model. Its primary objective is to maintain data integrity by preventing unauthorized modifications and ensuring internal and external consistency through well-formed transactions and separation of duties. While it dictates how data can be manipulated, it does not define the general rules for who can access what resources based on roles or attributes, which is the core function of an access control model.
- ✗
MAC
Why it's wrong here
Mandatory Access Control (MAC) operates on a strict, system-enforced policy where subjects and objects are assigned security labels, such as sensitivity levels and categories. Access is granted or denied based on a comparison of these labels, adhering to rules like "no read down" and "no write up." This model does not utilize roles or dynamic attributes for decision-making; instead, it relies on a rigid, predefined classification scheme enforced by the operating system or security kernel.
- ✓
ABAC
Why this is correct
Attribute-Based Access Control (ABAC) is a dynamic access control model that evaluates a set of attributes associated with the subject (user), object (resource), action (operation), and environment (context) to make real-time access decisions. This highly flexible approach allows for fine-grained control, enabling policies like "a manager in department X can approve expenses up to $500 during business hours." ABAC provides unparalleled granularity and adaptability, making it suitable for complex, evolving access requirements.
- ✓
RBAC
Why this is correct
Role-Based Access Control (RBAC) centralizes access management by assigning permissions to roles rather than directly to individual users. Users are then assigned to one or more roles, inheriting the permissions associated with those roles. This model simplifies administration, especially in large organizations, by aligning access privileges with job functions and organizational structure, ensuring that users only have the necessary permissions to perform their duties.
- ✗
DAC
Why it's wrong here
Discretionary Access Control (DAC) allows the owner of a resource to determine who can access it and what permissions they have. This model provides high flexibility for individual users but lacks centralized control and can lead to inconsistent security policies across an enterprise. DAC is generally unsuitable for environments requiring dynamic, organization-wide rules based on attributes, as it relies on individual discretion rather than a centrally enforced policy.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
RBAC
RBAC is a method of restricting network access based on the roles of individual users within an organization, where permissions are assigned to roles rather than to individuals directly.
Key term
ABAC
ABAC (Attribute-Based Access Control) is a method of controlling access to resources by evaluating a set of attributes (such as user role, time, location, and device) against policy rules, rather than using static roles or identities.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.