Study. uk . com
  1. Home
  2. All questions
  3. Question 337

CISSP study material · question 337 of 500

An architect describes access control lists and role based access control as fundamentally different models from attribute based access control. How does NIST SP 800-162 frame the relationship?

  1. Attributes are a subtype of roles, since every attribute can be expressed as a role.
  2. Both are special cases of attribute based control - one using identity as the attribute, the other role - and what distinguishes attribute based control is Boolean policy over many attributes.
  3. Lists and roles are deprecated models that attribute based control replaced.
  4. Lists and roles operate at the object level while attributes operate at the subject level, making them incomparable.
Show the answer

Answer: B. Both are special cases of attribute based control - one using identity as the attribute, the other role - and what distinguishes attribute based control is Boolean policy over many attributes.

Lists work on the attribute of identity and roles on the attribute of role; attribute based control adds Boolean policy over many attributes at once.

Source: NIST SP 800-162 (NIST) — SP 800-162 > 2.2 A Working Definition of ABAC

Challenge yourself on this topic → Study as cards