Certified Information Systems Security Professional CISSP · Free Practice Question Medium
Question 75
- A Dynamic separation of duty (DSD) relations through RBAC
- B Identity-based access control
- C Static separation of duty (SSD) relations through RBAC
- D Attribute-based access control
Reveal correct answer
Correct answer: C
Explanation
Correct Answer:
C is correct. In static separation of duty (SSD) relations through role-based access control (RBAC), fraud would be deterred by constraining the combination of privileges (such as the user cannot be a member of both the Cashier and Accounts Receivable groups).
Incorrect Answers:
A is incorrect. In dynamic separation of duty (DSD) relations through role-based access control (RBAC), fraud would be deterred by constraining the combination of privileges that can be activated in any session (for instance, the user cannot be in both the Cashier and Cashier Supervisor roles at the same time, but the user can be a member of both).
B is incorrect. Discretionary access control (DAC) systems grant or deny access based on the identity of the subject, rather than by security labels, roles, or attributes. The identity can be a user identity or a group membership. In the DAC model, user rights and privileges are typically cumulative and not constrained.
D is incorrect. Attribute-based access control (ABAC) uses attributes of any part of a system to define allowable access. These attributes can belong to subjects, objects, actions, or contexts.
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
