mediumMultiple ChoiceObjective-mapped
SSCP A security analyst at a financial institution Practice Question
You are a security analyst at a financial institution. The company uses a role-based access control (RBAC) system for its internal banking application. Recently, the compliance team discovered that a teller, who should only have access to customer account information for their branch, was able to view account details for customers in other branches. The RBAC system assigns roles based on job titles. You review the configuration and find that the 'Teller' role has a permission that allows viewing all customer accounts, regardless of branch. The company wants to enforce branch-level restrictions. Which of the following is the best approach to address this issue?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement attribute-based access control (ABAC) to incorporate branch location as an attribute.
ABAC extends RBAC by evaluating attributes (e.g., branch location) at access time, enabling fine-grained per-branch restrictions without role explosion. Option B is incorrect: MAC with labels would require re-labeling all accounts and users, which is complex and less flexible than ABAC for this dynamic requirement. Option C is incorrect because creating separate roles per branch leads to role explosion (many roles to manage) and does not scale well. Option D is insufficient because simply removing the permission to view all accounts would prevent tellers from seeing any branch data; they need branch-specific access, not a global removal.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Implement attribute-based access control (ABAC) to incorporate branch location as an attribute.
Why this is correct
Adding an attribute for branch location and using ABAC in conjunction with RBAC allows fine-grained control. This approach is scalable and minimizes administrative overhead because permissions are evaluated dynamically based on the user's branch attribute.
- ✗
Use mandatory access control (MAC) with labels for each customer account.
Why it's wrong here
Mandatory access control (MAC) with labels would require assigning sensitivity labels to each account and clearance labels to users, which is administrative heavy and not designed for attribute-based restrictions like branch location. It does not flexibly integrate with existing RBAC roles.
- ✗
Create separate roles for each branch, such as 'Teller_Branch1', 'Teller_Branch2', etc.
Why it's wrong here
Creating separate roles for each branch increases the number of roles dramatically (role explosion), leading to management complexity. Changes to teller permissions would need to be replicated across all branch roles, making this approach inefficient.
- ✗
Modify the 'Teller' role to remove the permission to view all accounts.
Why it's wrong here
Modifying the 'Teller' role to remove the permission to view all accounts would only prevent access to all accounts, but tellers still need to view accounts within their own branch. This solution does not provide branch-level granularity.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 920-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.