Which access control model uses attributes to make authorization decisions?

Which access control model uses attributes to make authorization decisions?

• A. RBAC
• B. ABAC
• C. DAC
• D. MAC

Answer: (B)

Attribute-based access control uses attributes to decide access. In ABAC, decisions are made by evaluating multiple attributes of the user, the resource, and the current context against a defined policy. This allows flexible, fine-grained rules that adapt to real-time circumstances. For example, you can permit reading a confidential document only if the requester works in the finance department, has the necessary clearance, and the request happens during business hours; if any attribute doesn’t match, access is denied. Other models base decisions on a different organizing idea. One relies on roles: access is granted because the user has a particular role, not because a set of attributes is being evaluated. Another follows discretionary control, where the owner decides who can access a resource, without a formal attribute-based rule. The remaining model uses fixed security classifications and mandatory labels enforced by a central authority, rather than evaluating user and resource attributes.

Attribute-based access control uses attributes to decide access. In ABAC, decisions are made by evaluating multiple attributes of the user, the resource, and the current context against a defined policy. This allows flexible, fine-grained rules that adapt to real-time circumstances. For example, you can permit reading a confidential document only if the requester works in the finance department, has the necessary clearance, and the request happens during business hours; if any attribute doesn’t match, access is denied.

Other models base decisions on a different organizing idea. One relies on roles: access is granted because the user has a particular role, not because a set of attributes is being evaluated. Another follows discretionary control, where the owner decides who can access a resource, without a formal attribute-based rule. The remaining model uses fixed security classifications and mandatory labels enforced by a central authority, rather than evaluating user and resource attributes.