Effective CISSP Questions

Your company decides to start the business of selling toys online and shipping globally. The E-Commerce system that supports the new business will be developed in-house by an integrated product team (IPT). In a meeting, the IPT is concerned with privacy issues and discussing the security controls to mitigate the data breach risk. Which of the following is least likely implemented?
A. Role-based Access Control
B. Rule-based Access Control
C. Mandatory Access Control
D. Attribute-based Access Control

Kindly be reminded that the suggested answer is for your reference only. It doesn’t matter whether you have the right or wrong answer. What really matters is your reasoning process and justifications.

My suggested answer is C. Mandatory Access Control.

Trusted Computing Base

Rule-based Access Control

In fact, every access control model can be classified as rule-based Access Control as authorization is always based on rules. A rule is typically implemented using a decision structure like IF…THEN…ELSE. A firewall is typically classified as the rule-based access control.
IF TCP.PORT = 80 THEN Allow Traffic

Attribute-based Access Control

The rules of the attribute-based access control are based on the subject’s attributes.
IF Age >= 20 and Age <= 30 and City = “Taipei” THEN Grant Access.

Role-based Access Control

A role differs from a group. A role can be viewed as a group with predefined privileges, while a group is just a collection of subjects. A user assigned with a role will be granted privileges of the role.

It’s common for an E-Commerce system to implement roles to entitle users. For example, VIP, Gold Member, Silver Member, and so on.

A role-based access control model, which defines the rules based on the attribute of role only, is a subtype of attribute-based access control.
IF ROLE = “VIP” THEN Allow Access.

Mandatory Access Control

Mandatory Access Control is based on the sensitivity labels. Objects will be classified and labeled. For simplicity, we refer to the subject’s security clearance as label as well.

The security kernel authorized the subject’s access to the object by comparing the labels. It’s common for a trusted computing system to implement the BLP model (no read up/no write down) or the Biba model (no read down/no write up) to define the label-based authorization rules.


  • It’s infeasible to conduct security clearance to the customers.
  • A firewall is commonly used to protect networks, which in turn protects the information systems and the information.

Leave a Reply