CISSP Identity and Access Management Practice Question
Which access control model bases decisions on attributes of the user, resource, and environment, and can use Boolean logic to define policies?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attribute-Based Access Control (ABAC)
Attribute-Based Access Control (ABAC) uses attributes and policies to grant access, offering fine-grained control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Role-Based Access Control (RBAC)
Why it's wrong here
Role-Based Access Control (RBAC) grants access permissions to specific roles, and users are then assigned to one or more of these predefined roles. Access decisions are primarily based on the user's assigned role membership, determining what actions they are authorized to perform. This model does not dynamically evaluate individual attributes of the subject or object at the time of access request, but rather relies on the static permissions associated with the assigned role.
- ✗
Discretionary Access Control (DAC)
Why it's wrong here
Discretionary Access Control (DAC) empowers the owner of a resource to define and manage access permissions for that specific resource. Under DAC, access decisions are made at the discretion of the resource owner, who can grant or revoke access to other users or groups. This model relies on identity-based access control lists or capabilities, rather than evaluating a dynamic set of attributes associated with the subject, object, or environment.
- ✓
Attribute-Based Access Control (ABAC)
Why this is correct
Attribute-Based Access Control (ABAC) makes access decisions by evaluating a comprehensive set of attributes associated with the subject (e.g., user's department, clearance level), the object (e.g., resource sensitivity, file type), the action being requested (e.g., read, write), and the environmental context (e.g., time of day, network location). This highly dynamic and granular model uses policies that define rules based on these combined attributes, enabling context-aware authorization beyond static roles or identities.
- ✗
Mandatory Access Control (MAC)
Why it's wrong here
Mandatory Access Control (MAC) enforces a system-wide security policy based on sensitivity labels assigned to both subjects and objects. Access is granted or denied according to strict, non-discretionary rules, such as the Bell-LaPadula model for confidentiality or the Biba model for integrity, which compare these fixed security labels and clearances. Decisions are based on a hierarchical classification system enforced by the operating system or security kernel, not on a dynamic evaluation of various user or resource attributes.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Identity and Access Management (IAM)
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
Key term
ABAC
ABAC (Attribute-Based Access Control) is a method of controlling access to resources by evaluating a set of attributes (such as user role, time, location, and device) against policy rules, rather than using static roles or identities.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.