A company is designing a new application that must enforce access policies. The architecture separates the component that evaluates policies from the component that intercepts the request and enforces the decision. Which components are being used?

Access control list (ACL) and capability table

Authentication server and authorization server

Policy Decision Point (PDP) and Policy Enforcement Point (PEP)

Policy Administration Point (PAP) and Policy Information Point (PIP)

An online banking platform wants to reduce fraud by requiring additional authentication when a user attempts a high-value transfer from a new device or unusual location. The system should assess the risk of each transaction and allow or deny based on that risk score. Which access control approach best fits this requirement?

Rule-Based Access Control with static rules for all transactions

Discretionary Access Control (DAC) with user-defined permissions

Risk-Based Access Control with contextual risk scoring

Role-Based Access Control (RBAC) with transaction limits per role

In access policy enforcement, what is the primary role of the Policy Decision Point (PDP)?

To enforce the access decision by allowing or denying the request

To authenticate the user and verify their identity

To evaluate access policies and make a decision on whether to allow access

To store the access policies and manage user attributes

Certified Information Systems Security Professional

Domain 5Objective 4

5.4 - Implement and Manage Authorization Mechanisms CISSP Practice Questions (Page 5)

Part of the Identity and Access Management (IAM) domain, which accounts for 13% of the CISSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~9–16 in this domain), expect 2–3 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

7concepts

13%of the exam

Questions 21–25

21application · medium
A company is designing a new application that must enforce access policies. The architecture separates the component that evaluates policies from the component that intercepts the request and enforces the decision. Which components are being used?
Select an answer first
22application · medium
An online banking platform wants to reduce fraud by requiring additional authentication when a user attempts a high-value transfer from a new device or unusual location. The system should assess the risk of each transaction and allow or deny based on that risk score. Which access control approach best fits this requirement?
Select an answer first
23foundation · easy
Which of the following is a common contextual factor used in risk-based access control?
Select an answer first
24foundation · easy
In access policy enforcement, what is the primary role of the Policy Decision Point (PDP)?
Select an answer first
25foundation · easy
In Discretionary Access Control (DAC), who has the authority to grant access to an object?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CISSP” is a trademark of its owner, used for identification only.

5.4 - Implement and Manage Authorization Mechanisms CISSP Practice Questions (Page 5)

Questions 21–25

A company is designing a new application that must enforce access policies. The architecture separates the component that evaluates policies from the component that intercepts the request and enforces the decision. Which components are being used?

Which of the following is a common contextual factor used in risk-based access control?

In access policy enforcement, what is the primary role of the Policy Decision Point (PDP)?

In Discretionary Access Control (DAC), who has the authority to grant access to an object?

Keep studying — Identity and Access Management (IAM)