CISSP Practice Question: Match each access control type to its description.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  DAC: Access rights are assigned based on the identity of the user and the discretion of the data owner.

  Why this is correct

  This correctly describes Discretionary Access Control (DAC), where the owner of a resource has full control over who can access it and what permissions they possess. Access rights are assigned directly to users or groups based on their identity, and the owner can grant or revoke these permissions at their discretion. This model offers high flexibility but can lead to inconsistent security policies across an organization.

• ✓

  MAC: Access is controlled by comparing security labels (e.g., classification) with user clearances; users cannot change access.

  Why this is correct

  This accurately defines Mandatory Access Control (MAC), a highly structured and rigid access control model. Access decisions are centrally enforced by the operating system or security kernel, comparing predefined security labels (e.g., 'Top Secret', 'Confidential') assigned to resources with clearance levels assigned to users. Users cannot override or modify these system-wide access rules, ensuring strict adherence to organizational security policies.

• ✓

  RBAC: Access permissions are granted based on the roles assigned to users within an organization.

  Why this is correct

  This correctly describes Role-Based Access Control (RBAC), a widely adopted model where access permissions are associated with specific job functions or roles within an organization. Users are assigned one or more roles, inheriting the permissions granted to those roles, rather than having permissions assigned directly to them. RBAC simplifies management, promotes the principle of least privilege, and ensures consistent access based on organizational responsibilities.

• ✓

  ABAC: Access decisions are made based on attributes of the user, resource, and environment.

  Why this is correct

  This accurately defines Attribute-Based Access Control (ABAC), a dynamic and fine-grained access control model. Access decisions are made by evaluating a set of attributes associated with the user (e.g., department, security clearance), the resource (e.g., sensitivity, type), and the environment (e.g., time of day, location). ABAC uses policy rules that combine these attributes to determine access, offering high flexibility and context-awareness.

• ✗

  DAC: Access is controlled by comparing security labels with user clearances; users cannot change access.

  Why it's wrong here

  This statement is incorrect for Discretionary Access Control (DAC). DAC is characterized by resource owners having the discretion to set access permissions, typically based on user identity. The description provided, which involves comparing security labels with user clearances and preventing users from changing access, precisely defines Mandatory Access Control (MAC), a system-enforced and non-discretionary model.

• ✗

  RBAC: Access decisions are based on attributes of the user, resource, and environment.

  Why it's wrong here

  This statement is incorrect for Role-Based Access Control (RBAC). RBAC grants access permissions based on a user's assigned organizational role, not on a dynamic evaluation of various attributes. The description, which states that access decisions are based on attributes of the user, resource, and environment, accurately describes Attribute-Based Access Control (ABAC), a more granular and context-aware access control model.

Go deeper

Related to this question