hardMultiple ChoiceObjective-mapped
SSCP Uses role-based access control (RBAC) Practice Question
An organization uses role-based access control (RBAC). A user complains that they can access a resource they were previously denied. The security administrator finds that the user's role was recently changed. What is the most likely cause?
⚠ Common exam trap
A common mix-up: candidates assume a role change always removes old permissions, but RBAC role hierarchies can cause permission accumulation through inheritance, leading to new access that was previously denied.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The user's new role inherits permissions from multiple roles that collectively grant access.
In RBAC, permissions are assigned to roles, not directly to users. When a user's role changes, the new role may have a different set of permissions. If the new role inherits permissions from multiple roles (e.g., through role hierarchy or composite roles), it can collectively grant access to resources that were previously denied under the old role. This is the most likely cause because the security administrator confirmed the role change, and RBAC systems typically enforce permissions based on the current role membership.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The user's previous role was not properly removed.
Why it's wrong here
Role removal issues could cause lingering access, but the user was previously denied.
- ✗
The RBAC implementation has a bug that grants excessive permissions.
Why it's wrong here
While possible, the most likely cause is role inheritance.
- ✓
The user's new role inherits permissions from multiple roles that collectively grant access.
Why this is correct
In RBAC, roles can inherit permissions, leading to unintended access.
- ✗
The user was directly assigned permissions to the resource.
Why it's wrong here
Direct assignment is less likely in a pure RBAC model.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 920-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.