Study. uk . com
  1. Home
  2. All questions
  3. Question 338

CISSP study material · question 338 of 500

In role based access control, who determines what a subject may reach? Choose two.

  1. Whoever assigns roles to individuals sets it implicitly.
  2. The subject sets it by selecting an active role at login.
  3. The access control mechanism sets it by evaluating environmental conditions.
  4. The object owner sets it explicitly by deciding the privileges attached to each role.
Show the answer

Answer: A. Whoever assigns roles to individuals sets it implicitly.
D. The object owner sets it explicitly by deciding the privileges attached to each role.

SP 800-162 describes access as implicitly predetermined by the person assigning roles to each individual, and explicitly by the object owner when determining the privileges associated with each role.

Source: NIST SP 800-162 (NIST) — SP 800-162 > 2. Understanding ABAC, RBAC

Challenge yourself on this topic → Study as cards