Certified Information Systems Security Professional (CISSP) Practice Exam

What shapes the structure of RBAC?

1. The individual needs of every user

2. The organizational needs and roles

3. The system’s hardware configuration

4. The network architecture

The correct answer is: The organizational needs and roles

The structure of Role-Based Access Control (RBAC) is primarily shaped by the organizational needs and roles within that organization. RBAC is designed to manage user access based on their specific roles rather than focusing on individuals' unique requirements. This approach simplifies the administration of permissions by grouping users into roles that correspond to job functions. Each role has defined access rights, which enables organizations to enforce security policies consistently and efficiently. By aligning access control with the structure and needs of the organization, RBAC ensures that users can only access the resources necessary for their roles, adhering to the principle of least privilege. This alignment helps streamline access management, improves security by reducing the risk of excessive privileges, and enhances compliance with regulatory requirements. In contrast, focusing on the individual needs of every user would complicate access control and potentially lead to security vulnerabilities. Additionally, while hardware configuration and network architecture are important in the overall security framework, they do not define the structure of RBAC itself, which is fundamentally oriented around organizational roles and responsibilities.