A security architect is designing access control for a new cloud-based application. The compliance team requires that access decisions be based on the user's role, the sensitivity of the data, and the user's location. The architect must also ensure that the solution is scalable and can be updated quickly. Which authorization approach should the architect choose?

Discretionary access control (DAC)

Role-based access control (RBAC)

Attribute-based access control (ABAC)

A financial services firm is implementing a new trading platform. The compliance officer requires that no single employee can both enter a trade and approve the same trade. The system must enforce this control automatically at the application level. Which authorization principle should the architect apply?

Discretionary Access Control (DAC)

Attribute-based access control (ABAC)

Which statement correctly differentiates interactive from non-interactive authorization?

Interactive authorization is used only for local access; non-interactive authorization is used only for remote access.

Interactive authorization requires multi-factor authentication; non-interactive authorization does not require any authentication.

Interactive authorization occurs when a user logs on with a password; non-interactive authorization occurs when a service runs under a service account without user interaction.

Interactive authorization is always more secure than non-interactive authorization.

Which term describes a collection of users who share the same access permissions to a resource?

Digital rights management (DRM)

Information Systems Security Architecture Professional

Domain 4Objective 3

4.3 Architect Identity Authorization ISSAP Practice Questions (Page 3)

Part of the Identity and Access Management (IAM) Architecture domain, which accounts for 25% of the ISSAP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–30 in this domain), expect 5–8 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

6concepts

25%of the exam

Questions 11–15

11expert · hard
A security architect is designing access control for a new cloud-based application. The compliance team requires that access decisions be based on the user's role, the sensitivity of the data, and the user's location. The architect must also ensure that the solution is scalable and can be updated quickly. Which authorization approach should the architect choose?
Select an answer first
12application · medium
A financial services firm is implementing a new trading platform. The compliance officer requires that no single employee can both enter a trade and approve the same trade. The system must enforce this control automatically at the application level. Which authorization principle should the architect apply?
Select an answer first
13foundation · easy
An organization requires that no single administrator can both approve a new vendor account and create that account in the identity management system. Which authorization principle is being applied?
Select an answer first
14foundation · easy
Which statement correctly differentiates interactive from non-interactive authorization?
Select an answer first
15foundation · easy
Which term describes a collection of users who share the same access permissions to a resource?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSAP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSAP” is a trademark of its owner, used for identification only.

4.3 Architect Identity Authorization ISSAP Practice Questions (Page 3)

Questions 11–15

An organization requires that no single administrator can both approve a new vendor account and create that account in the identity management system. Which authorization principle is being applied?

Which statement correctly differentiates interactive from non-interactive authorization?

Which term describes a collection of users who share the same access permissions to a resource?

Keep studying — Identity and Access Management (IAM) Architecture