mediumMultiple ChoiceObjective-mapped
SSCP Role-Based Access Control (RBAC) Practice Question
A company uses role-based access control (RBAC). A user is assigned to the 'Sales' role, which grants access to CRM and reporting, and also to the 'Sales Manager' role, which grants additional access to team reports. However, the user cannot access team reports. What is the most likely cause?
⚠ Common exam trap
A common trap is assuming that all assigned roles are automatically active. In practice, session management controls which roles are currently active, and thus which permissions are available.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The user's session is not properly managed
In an RBAC system, users are assigned roles, and they establish a session during which they select which authorized roles to activate. If the user's session is not properly managed—for example, they activated only the 'Sales' role and not the 'Sales Manager' role—they would not have the permissions from the 'Sales Manager' role, thus preventing access to team reports. Even though both roles are assigned, the active role set determines effective permissions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
An access control list on the report folder explicitly denies the 'Sales' role
Why it's wrong here
An explicit deny on the 'Sales' role would affect that role's permissions, but the user also has 'Sales Manager' which is not denied. In standard RBAC, permissions are additive, so the 'Sales Manager' permissions would still apply unless the system uses conflict resolution that enforces denials across roles, which is not typical.
- ✗
The user account has been disabled
Why it's wrong here
A disabled account would prevent all access, not just team reports.
- ✗
RBAC role hierarchy is not configured
Why it's wrong here
Role hierarchy is used to define inheritance relationships (e.g., 'Sales Manager' inherits 'Sales' permissions). It is not required to combine permissions from separate role assignments; RBAC inherently unions all assigned and activated roles.
- ✓
The user's session is not properly managed
Why this is correct
Correct. In RBAC, a user's effective permissions are determined by the roles activated in the current session. If the 'Sales Manager' role is not activated, its permissions are not available.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
One of 920 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.