Which authorization approach grants access based on a set of policies that evaluate attributes of the user, resource, and environment?

Attribute-based access control (ABAC)

Role-based access control (RBAC)

A university is implementing a new research data management system. The system must allow individual researchers to decide who can access their datasets, but the university also needs to enforce a policy that prevents students from accessing faculty-only research. Which combination of authorization models should the architect use?

Mandatory access control (MAC) for datasets and discretionary access control (DAC) for faculty-only research

Role-based access control (RBAC) for datasets and discretionary access control (DAC) for faculty-only research

Attribute-based access control (ABAC) for datasets and role-based access control (RBAC) for faculty-only research

Discretionary access control (DAC) for datasets and mandatory access control (MAC) for faculty-only research

Which authorization model is primarily concerned with defining policies and procedures for granting and reviewing access rights?

Administrative authorization model

Discretionary authorization model

A security architect is designing a PAM solution for a large enterprise. The goal is to ensure that privileged sessions are monitored and that actions are recorded for audit purposes. Which PAM feature should the architect include?

Role-based access control (RBAC)

Session recording and monitoring

Information Systems Security Architecture Professional

Domain 4Objective 3

4.3 Architect Identity Authorization ISSAP Practice Questions (Page 1)

Part of the Identity and Access Management (IAM) Architecture domain, which accounts for 25% of the ISSAP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–30 in this domain), expect 5–8 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

6concepts

25%of the exam

Questions 1–5

1foundation · easy
Which authorization approach grants access based on a set of policies that evaluate attributes of the user, resource, and environment?
Select an answer first
2foundation · easy
An employee is on extended leave. The security team temporarily disables the employee's access to the corporate network. Which authorization lifecycle phase does this action represent?
Select an answer first
3application · hard
A university is implementing a new research data management system. The system must allow individual researchers to decide who can access their datasets, but the university also needs to enforce a policy that prevents students from accessing faculty-only research. Which combination of authorization models should the architect use?
Select an answer first
4foundation · easy
Which authorization model is primarily concerned with defining policies and procedures for granting and reviewing access rights?
Select an answer first
5application · medium
A security architect is designing a PAM solution for a large enterprise. The goal is to ensure that privileged sessions are monitored and that actions are recorded for audit purposes. Which PAM feature should the architect include?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSAP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSAP” is a trademark of its owner, used for identification only.

4.3 Architect Identity Authorization ISSAP Practice Questions (Page 1)

Questions 1–5

Which authorization approach grants access based on a set of policies that evaluate attributes of the user, resource, and environment?

An employee is on extended leave. The security team temporarily disables the employee's access to the corporate network. Which authorization lifecycle phase does this action represent?

Which authorization model is primarily concerned with defining policies and procedures for granting and reviewing access rights?

A security architect is designing a PAM solution for a large enterprise. The goal is to ensure that privileged sessions are monitored and that actions are recorded for audit purposes. Which PAM feature should the architect include?

Keep studying — Identity and Access Management (IAM) Architecture