Which access control model uses attributes (user, resource, environment) to make dynamic access decisions?

• A. RBAC
• B. ABAC
• C. DAC
• D. MAC

Answer: (B)

Dynamic, attribute-driven decision making is the essence of ABAC. In this model, access is controlled by evaluating a set of attributes from three areas: the user (identity, department, role, clearance), the resource (type, sensitivity, ownership), and the environment (time, location, device state, risk level). When a request comes in, policies are checked against these attributes, and access is granted or denied based on whether the combination satisfies the rules. This lets you enforce fine-grained, context-aware controls that can adapt as conditions change.

RBAC relies on assigning permissions to roles and then granting those roles to users, so access tracks role membership rather than dynamic attributes. DAC grants permissions based on the resource owner’s discretion, not attribute evaluation. MAC uses fixed security labels and a lattice to enforce access, independent of user attributes.