easyMultiple Choice
SSCP Uses role-based access control (RBAC) Practice Question
An organization uses role-based access control (RBAC). An employee transfers from the Sales department to the Marketing department. What is the most secure way to update the employee's access?
⚠ Common exam trap
Candidates often think adding the new role first ensures continuity of access, but the most secure approach is to remove the old role first to prevent any period of dual access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Remove the Sales role and then add the Marketing role
In RBAC, access is determined by the roles assigned to a user. The most secure method is to remove the old role (Sales) first to eliminate any residual permissions, then add the new role (Marketing). This ensures the employee does not retain access to Sales resources during the transition, adhering to the principle of least privilege.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Remove the Sales role and then add the Marketing role
Why this is correct
Removing the Sales role first revokes all inherited Sales permissions before the Marketing role is granted, preventing any window where the employee holds both roles' privileges. This satisfies RBAC's least-privilege constraint during the transfer, avoiding cumulative access that sequential addition alone would leave in place.
- ✗
Add the Marketing role and remove the Sales role after 30 days
Why it's wrong here
Retaining the Sales role for 30 days leaves the employee holding Marketing plus unnecessary Sales permissions, violating least privilege and separation of duties. It is tempting because delayed revocation is used during handover periods where transitional access is genuinely required, but RBAC transfers should revoke the old role immediately.
- ✗
Modify the Sales role to include Marketing permissions
Why it's wrong here
Editing the Sales role to include Marketing permissions grants every Sales user Marketing access, breaking role integrity and violating least privilege. It is tempting because it avoids creating a new role, and role modification is correct when a job function permanently changes for an entire group, not for one transferring employee.
- ✗
Create a new custom role with combined permissions
Why it's wrong here
RBAC grants access through role assignments, so the secure fix is removing the Sales role assignment and adding the Marketing one; a combined custom role leaves Sales permissions intact, violating least privilege. Custom roles suit genuinely unique job functions that no built-in role covers, not departmental transfers.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
One of 971 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.