hardMultiple ChoiceObjective-mapped
CISSP Uses a role-based access control (RBAC) model Practice Question
An organization uses a role-based access control (RBAC) model. After an audit, it was discovered that users have accumulated excessive permissions due to role proliferation. The security architect proposes migrating to an attribute-based access control (ABAC) model. Which challenge is MOST likely to be encountered during this migration?
⚠ Common exam trap
Many exam-takers confuse the operational challenge of performance (Option B) with the architectural challenge of attribute management, but CISSP emphasizes that the most significant hurdle in ABAC adoption is the complexity of defining and governing attributes, not the runtime evaluation speed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Increased complexity in defining and managing attributes.
Migrating from RBAC to ABAC requires defining a comprehensive set of attributes (subject, resource, environment) and the policies that combine them, which is inherently more complex than managing static role assignments. Role proliferation in RBAC often results from an attempt to mimic attribute-based decisions, but ABAC shifts the complexity from role engineering to attribute governance and policy logic, making attribute definition and management the primary challenge.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Difficulty in assigning roles to users.
Why it's wrong here
Attribute-Based Access Control (ABAC) fundamentally shifts away from the role-centric model of RBAC. Instead of assigning users to predefined roles, ABAC grants access based on a dynamic evaluation of attributes associated with the user, resource, action, and environment. Therefore, the concept of "assigning roles to users" is largely irrelevant and not a challenge within a pure ABAC implementation, which relies on attribute-driven policies.
- ✗
Reduced performance due to policy evaluation overhead.
Why it's wrong here
While ABAC's real-time evaluation of potentially complex policies involving numerous attributes can indeed introduce performance overhead, particularly in high-volume transaction systems, this is often a scaling or optimization concern that arises post-implementation. The initial and most significant hurdle in adopting ABAC is typically related to the foundational setup and ongoing maintenance of the attribute infrastructure and policy definitions, rather than immediate runtime performance bottlenecks.
- ✗
Lack of support for ABAC in legacy applications.
Why it's wrong here
Although integrating ABAC with older, legacy applications not originally designed for attribute-based authorization can present challenges, many modern Identity and Access Management (IAM) solutions offer ABAC capabilities that can be integrated or layered over existing systems. The primary difficulty often lies more in standardizing and managing the diverse attributes required for ABAC policies across disparate systems, rather than a universal absence of technical support for ABAC itself.
- ✓
Increased complexity in defining and managing attributes.
Why this is correct
ABAC's power derives from its ability to make fine-grained access decisions based on a multitude of attributes related to the user, resource, action, and environment. This necessitates a robust and consistent attribute taxonomy, requiring significant upfront effort to define, standardize, collect, and maintain these attributes across various identity stores and systems. The sheer volume, dynamic nature, and precision required for attributes, coupled with their lifecycle management, represent the most substantial initial and ongoing complexity in an ABAC implementation.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.