Study. uk . com
  1. Home
  2. All questions
  3. Question 341

CISSP study material · question 341 of 500

An organisation relying on access control lists finds long-serving staff hold far more access than their current jobs require. Which characteristic of the list model does NIST SP 800-162 identify as the cause?

  1. Lists cannot be applied to subjects who belong to more than one group.
  2. Lists are evaluated only at object creation, never at access time.
  3. Lists cannot express deny rules, so every grant is permanent.
  4. The decision is static, so unless something prompts the owner to re-examine it as circumstances change, privileges accumulate.
Show the answer

Answer: D. The decision is static, so unless something prompts the owner to re-examine it as circumstances change, privileges accumulate.

The list decision is static and needs something to prompt re-evaluation as circumstances change; failure to revoke leaves users accumulating privileges they no longer need.

Source: NIST SP 800-162 (NIST) — SP 800-162 > 2. Understanding ABAC, ACL

Challenge yourself on this topic → Study as cards