CISSP - Identity and Access Management (IAM) (13% of the exam) - Section 5.4

Implement and manage authorization mechanisms such as RBAC, rule-based, MAC, DAC, ABAC, and risk-based access control.

Compare role-based (RBAC), rule-based, mandatory (MAC), discretionary (DAC), attribute-based (ABAC), and risk-based access control models in terms of their enforcement mechanisms and administrative overhead. Select the most appropriate model given the sensitivity requirements, organisational structure, and dynamic access context.

RBACMACDACABACrisk-based access control

Practice question for this objective

Free sampleIdentity and Access Management (IAM)hard

A mid-sized insurer is rolling out a claims platform that will be used by adjusters, supervisors, fraud investigators, and external loss assessors. The CISO wants entitlements to remain stable as people move between branches and as the company acquires smaller brokers. Joiner-mover-leaver volumes have tripled in eighteen months and HR has just published a tidy job catalogue. Which authorization model should the security architect recommend as the primary basis for access decisions on the new platform?

ARole-based access control aligned to the HR job catalogue, with role assignments driven by position changes Correct
BDiscretionary access control, so each claims manager can grant their team the entitlements they need on the cases they own
CAttribute-based access control evaluating dozens of user, resource, and environmental attributes on every request
DMandatory access control with sensitivity labels assigned to every claim file and cleared per user

Select RBAC as the primary authorization model when an authoritative role catalogue and high workforce churn favour stable, role-mediated entitlements. CISSP guidance treats RBAC as the default enterprise model when roles can be derived from an authoritative source such as HR, because access is granted to roles rather than to individuals, which decouples entitlements from personal grants and survives joiner-mover-leaver and M and A activity. DAC, MAC, and rich ABAC are appropriate in narrower contexts and are harder to govern as the first lever.

Why A is correct: RBAC anchored to an authoritative HR catalogue scales cleanly across branches and acquisitions: people move, their role assignment moves, and entitlements follow without ad hoc grants.

Why B is wrong: DAC pushes grant decisions to data owners, which feels responsive but produces inconsistent entitlements across branches and is exactly what struggles under high joiner-mover-leaver churn and acquisitions.

Why C is wrong: ABAC is powerful and a defensible second choice, but starting an enterprise rollout there is over-engineered when a clean job catalogue already supports a simpler RBAC baseline that the business can govern.

Why D is wrong: MAC suits classified or strongly regulated label-driven environments; imposing labels and clearances on commercial claims data adds operational burden without matching the actual confidentiality model of the business.

See more CISSP practice questions, answers explained.

Exam traps in Identity and Access Management (IAM)

Answers that look right on this material and are not. Each one is a distractor from a different question in the CISSP bank for this domain.

Rule-based access control that enforces a fixed allow list of countries and device fingerprints regardless of the live session risk
Why it is wrong: Static rule-based controls miss the point of contextual fraud signals; legitimate customers travel and switch devices, and rigid lists generate false positives without responding to the actual risk picture.
Role-based access control with a separate role for each combination of job, employing entity, and country to capture the policy variations
Why it is wrong: RBAC alone forces a role explosion when entitlements depend on many orthogonal attributes; this is the classic failure mode that drives organisations toward ABAC and is not the BEST primary choice here.
Keep the keyed lock but issue a separate key to every member of branch staff so that nobody has to share.
Why it is wrong: Tempting because it removes the shared-key problem, but physical keys cannot be revoked cleanly when staff leave or change role, produce no log of entries, and still grant access far more broadly than the cash-handling role requires.

Examworthy is not affiliated with or endorsed by ISC2. Original, blueprint-aligned practice material only.