nerdexam
(ISC)2

CSSLP · Question #238

Mark works as a Network Administrator for NetTech Inc. He wants users to access only those resources that are required for them. Which of the following access control models will he use?

The correct answer is D. Role-Based Access Control. Role-Based Access Control (RBAC) is the most suitable model for assigning access based on a user's organizational function, ensuring they only access resources necessary for their job responsibilities.

Secure Software Concepts

Question

Mark works as a Network Administrator for NetTech Inc. He wants users to access only those resources that are required for them. Which of the following access control models will he use?

Options

  • ADiscretionary Access Control
  • BMandatory Access Control
  • CPolicy Access Control
  • DRole-Based Access Control

How the community answered

(49 responses)
  • A
    2% (1)
  • B
    2% (1)
  • C
    6% (3)
  • D
    90% (44)

Why each option

Role-Based Access Control (RBAC) is the most suitable model for assigning access based on a user's organizational function, ensuring they only access resources necessary for their job responsibilities.

ADiscretionary Access Control

Discretionary Access Control (DAC) allows resource owners to determine access, which can lead to inconsistent and overly permissive access, not strictly limiting users to only what they require.

BMandatory Access Control

Mandatory Access Control (MAC) is based on security labels and strict rules, typically used in highly secure environments, and is less about job function necessity and more about classification levels.

CPolicy Access Control

Policy Access Control is a general term and not a distinct access control model like RBAC, DAC, or MAC; policies are used to implement access control, not a model itself.

DRole-Based Access ControlCorrect

Role-Based Access Control (RBAC) assigns permissions to roles, and users are assigned to roles, thereby granting them access to only the resources required by their job function or duties.

Concept tested: Access control models - Role-Based Access Control

Source: https://nvlpubs.nist.gov/nistpubs/specialpublications/sp800-162.pdf

Topics

#Access Control Models#Role-Based Access Control (RBAC)#Principle of Least Privilege

Community Discussion

No community discussion yet for this question.

Full CSSLP Practice