ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question

Access control lists (ACLs) are designed to tie specific subjects (users or groups) directly to specific objects and enumerate the exact operations (read, write, execute, etc.) each subject may perform on that object. This makes ACLs well suited to environments where authorization decisions must vary at the individual resource level, such as assigning different user permissions to each document in a multitenant application.

Role-based access control relies on predefined roles mapped to permissions, so it is less flexible when the set of authorized users changes for every object. Attribute-based access control could meet the requirement only if subject and object attributes were leveraged-not just environment attributes alone-so using environment attributes exclusively would be insufficient. Mandatory access control focuses on fixed security labels and clearances administered centrally and is typically too rigid for dynamic, object-specific sharing needs. Therefore, an ACL provides the most straightforward and appropriate mechanism in this scenario.