Once a subject is authenticated, an authorization mechanism decides what it may do. The CISSP exam tests several models, and questions usually turn on two things: who makes the access decision, and what the decision is based on. If you learn each model by those two questions, most scenario questions become straightforward. Real organizations mix models, so expect scenarios where different layers of the same system use different ones.
Free account
Keep reading for free
Create a free StudyToCert account to read the rest of this lesson: 7 more sections, 7 key terms, a real-world example, an exam tip and self-check questions. Every lesson, lab and practice test is free with an account.