Study. uk . com
  1. Home
  2. All questions
  3. Question 346

CISSP study material · question 346 of 500

An auditor must show that a stated access requirement is met across an estate using access control lists and roles. Which two difficulties does NIST SP 800-162 identify? Choose two.

  1. Demonstrating compliance is costly because of the abstraction between the requirement and the implementation.
  2. When a requirement changes it is hard to identify every place the implementation must be updated.
  3. Lists and roles cannot be audited without the object owner's participation.
  4. Lists and roles cannot express deny decisions, so requirements cannot be stated negatively.
Show the answer

Answer: A. Demonstrating compliance is costly because of the abstraction between the requirement and the implementation.
B. When a requirement changes it is hard to identify every place the implementation must be updated.

Demonstrating compliance is costly because of the abstraction involved, and a changed requirement is hard to trace to every place the implementation must be updated.

Source: NIST SP 800-162 (NIST) — SP 800-162 > 2.2 A Working Definition of ABAC

Challenge yourself on this topic → Study as cards