Which of the following prevents improper aggregation of privileges in Role Based Access Control (RBAC)?

Question

Options

• AHierarchical inheritance
• BDynamic separation of duties
• CThe Clark-Wilson security model
• DThe Bell-LaPadula security model

• A
  2% (1)
• B
  94% (60)
• C
  3% (2)
• D
  2% (1)

Explanation

Dynamic Separation of Duties (DSoD) prevents improper aggregation of privileges in RBAC by enforcing constraints at runtime - ensuring a user cannot activate conflicting roles simultaneously within the same session, even if they hold multiple roles. This directly addresses the threat of privilege accumulation, where a single user combines roles to gain excessive access.

Why the distractors are wrong:

• A. Hierarchical inheritance actually enables privilege accumulation by allowing child roles to inherit permissions from parent roles - it's a feature, not a safeguard against aggregation.
• C. Clark-Wilson is an integrity model focused on well-formed transactions and separation of duties in commercial contexts, but it is not specific to RBAC role conflict prevention.
• D. Bell-LaPadula is a confidentiality model built around "no read up, no write down" rules for multilevel security - it doesn't address role assignment conflicts.

Memory tip: Think of "Dynamic" as in-the-moment enforcement - DSoD stops you from wearing two hats at once, while Static Separation of Duties (SSoD) stops you from owning conflicting roles at all. Exam questions about preventing aggregation during active use point to Dynamic SoD.

No community discussion yet for this question.