mediumMultiple SelectObjective-mapped
CISSP Practice Question: Is implementing role-based access control (RBAC)
An organization is implementing role-based access control (RBAC). Which two components are fundamental to the RBAC model? (Select TWO.)
⚠ Common exam trap
Many candidates confuse the generic components of access control (subjects, objects, operations) with the specific fundamental components of the RBAC model, leading them to select Option B instead of recognizing that roles, permissions, user assignments, and constraints are the unique building blocks of RBAC.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Constraints such as separation of duties
Constraints such as separation of duties are fundamental to RBAC because they enforce organizational policies by preventing conflicts of interest (e.g., a user cannot both create and approve a purchase order). This is a core component of the RBAC model as defined in the NIST RBAC standard (ANSI INCITS 359-2004), which includes core RBAC, hierarchical RBAC, and constrained RBAC. Constraints ensure that role assignments and permissions adhere to security rules beyond simple role-user mapping.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Access control lists (ACLs)
Why it's wrong here
Access Control Lists (ACLs) are a core component of Discretionary Access Control (DAC) models, where they directly specify permissions for individual users or groups on specific resources. Unlike RBAC, which abstracts permissions into roles, ACLs require direct management of permissions for each subject-object pair. This granular, resource-centric approach contrasts with RBAC's user-to-role-to-permission structure, making ACLs less scalable for large organizations.
- ✗
Subjects, objects, and operations
Why it's wrong here
Subjects, objects, and operations are fundamental elements present in virtually all access control models, defining who (subject) can do what (operation) to which resource (object). While RBAC certainly involves these concepts, they are universal building blocks rather than unique defining characteristics of RBAC itself. RBAC distinguishes itself by introducing the "role" as an intermediary layer between subjects and permissions, abstracting the direct subject-to-operation-on-object relationship.
- ✓
Constraints such as separation of duties
Why this is correct
Constraints are an integral and advanced feature of robust RBAC implementations, designed to enforce organizational security policies beyond simple permission grants. Separation of duties (SoD), for example, is a critical constraint that prevents a single user from being assigned conflicting roles or permissions that could lead to fraud or error. These constraints ensure that the accumulation of privileges by any individual is carefully controlled, thereby enhancing the overall security posture.
- ✓
Roles, permissions, and user assignments
Why this is correct
Roles, permissions, and user assignments represent the foundational and defining components of Role-Based Access Control. A role is a collection of permissions (privileges to perform specific operations on specific objects), and users are assigned to one or more roles based on their job functions. This structure allows for efficient management of access rights, as changes to a role's permissions automatically apply to all assigned users, simplifying administration and ensuring consistency.
- ✗
Security labels and clearances
Why it's wrong here
Security labels and clearances are central to Mandatory Access Control (MAC) models, not RBAC. In MAC, every subject and object is assigned a security label (e.g., "Confidential," "Secret"), and access is granted or denied based on a comparison of these labels according to strict, system-enforced rules. This hierarchical, classification-based approach is fundamentally different from RBAC, which bases access decisions on a user's assigned job function or role within an organization.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
RBAC
RBAC is a method of restricting network access based on the roles of individual users within an organization, where permissions are assigned to roles rather than to individuals directly.
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.