CISSP Practice Question (Domain 8: Software Development Security)

Your engineering team integrates a third-party AI API that generates dynamic access control policies based on user behavior analytics. During testing, the API occasionally grants excessive permissions that violate least privilege. What should you address FIRST?

A. Implement a policy validation layer that enforces least privilege before applying AI-generated rules

B. Request the AI vendor to retrain the model to reduce permission over-granting

C. Revert to static role-based access control until the AI system is reliable

D. Log all AI-generated policy decisions for quarterly audit review

Come back for the answer tomorrow, or study more now!

18 comments