mediumMultiple ChoiceObjective-mapped
ISC2 CC Practice Question: Implementing an access control system to protect…
A company is implementing an access control system to protect sensitive data. Employees in the finance department must access financial records, but only during business hours and from company-issued devices. Which access control model best supports these requirements?
⚠ Common exam trap
ISC2 often tests the distinction between RuBAC and ABAC by presenting a scenario with multiple conditions (time, device, location) that seems to require ABAC, but the trap is that if the conditions are static and predefined (not evaluated dynamically from user/object attributes), RuBAC is the simpler and correct model.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Rule-Based Access Control (RuBAC)
Rule-Based Access Control (RuBAC) is the correct choice because it enforces access decisions based on a set of predefined rules, such as time-of-day restrictions and device compliance. In this scenario, the rules 'business hours only' and 'company-issued devices only' are static conditions that can be implemented as access control rules (e.g., using a firewall ACL or a policy engine) without requiring user attributes or labels. RuBAC is ideal when access is governed by operational policies that are not tied to user identity or data classification.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Attribute-Based Access Control (ABAC)
Why it's wrong here
Attribute-Based Access Control (ABAC) is tempting as it directly addresses the scenario's need for granular access decisions based on user, resource, and environmental attributes like time of day and device compliance. However, while ABAC can certainly implement these rules, it is a very broad and flexible model. For scenarios with clearly defined roles and specific environmental conditions, a more structured approach like Role-Based Access Control (RBAC) augmented with conditional access policies often provides a more direct and manageable implementation, especially when integrating with identity providers like Microsoft Entra ID. ABAC excels in highly dynamic environments requiring complex, fine-grained authorisation beyond simple roles.
- ✓
Rule-Based Access Control (RuBAC)
Why this is correct
RuBAC enforces access based on rules including time and device.
- ✗
Discretionary Access Control (DAC)
Why it's wrong here
DAC allows users to control access, not enforce time/device rules.
- ✗
Mandatory Access Control (MAC)
Why it's wrong here
MAC uses labels like Top Secret, not time or device restrictions.
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Security Governance and Compliance
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
Key term
Data classification
Data classification is the process of organizing data into categories based on its sensitivity, value, and criticality to an organization, so that appropriate security controls can be applied.
About these practice questions
This CC question is part of Courseiva's 976-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.