Study. uk . com
  1. Home
  2. All questions
  3. Question 339

CISSP study material · question 339 of 500

An architect argues that role based and attribute based control cannot coexist because roles are not attributes. What does NIST SP 800-162 say?

  1. Roles are object properties and so cannot be evaluated as subject attributes.
  2. Roles are environment conditions and vary independently of the subject.
  3. Roles are policies rather than attributes and must be replaced wholesale.
  4. A role may be viewed as one subject attribute, evaluated by the mechanism like any other.
Show the answer

Answer: D. A role may be viewed as one subject attribute, evaluated by the mechanism like any other.

SP 800-162 notes a role may be viewed as a subject attribute that the access control mechanism evaluates and around which object access policy is generated.

Source: NIST SP 800-162 (NIST) — SP 800-162 > 2. Understanding ABAC, RBAC

Challenge yourself on this topic → Study as cards