SSCP Access Controls Practice Question
A security administrator needs to implement an access control model that grants access based on attributes of the user, resource, and environment, using policy rules. Which model is most appropriate?
⚠ Common exam trap
SSCP often tests the distinction between access control models by describing the decision input — candidates who see 'role' or 'label' keywords jump to RBAC or MAC, missing that the question specifies attributes of user, resource, and environment, which uniquely identifies ABAC.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attribute-Based Access Control (ABAC)
ABAC is the correct answer because it evaluates access decisions dynamically using policy rules that combine attributes of the subject (user), the object (resource), and the environment (context such as time or location). This multi-attribute, policy-driven evaluation is the defining characteristic of ABAC, typically implemented via XACML or similar policy engines. MAC, DAC, and RBAC do not natively incorporate environmental or arbitrary resource attributes into their access decisions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Attribute-Based Access Control (ABAC)
Why this is correct
ABAC evaluates policy rules against attributes of subject, object and environment, so access decisions dynamically reflect context rather than static role or label assignments. This directly satisfies the requirement to grant access based on user, resource and environmental attributes.
- ✗
Mandatory Access Control (MAC)
Why it's wrong here
MAC assigns sensitivity labels to objects and clearances to subjects, enforcing access through mandatory lattice rules rather than dynamic attribute evaluation. It is tempting because labels are centrally enforced and tamper-resistant, and it would be correct in high-assurance environments needing strict confidentiality compartments.
- ✗
Discretionary Access Control (DAC)
Why it's wrong here
DAC bases access on the resource owner's discretion, recorded in access control lists, and evaluates no user, resource or environment attributes against policy rules. It is tempting because owners can grant access flexibly, and it would be correct where individual owners must control sharing of their own files.
- ✗
Role-Based Access Control (RBAC)
Why it's wrong here
RBAC grants permissions through roles assigned to users, so decisions derive from role membership rather than evaluated attributes of user, resource and environment. It is tempting because roles scale cleanly across large organisations, and it would be correct where job functions map neatly to fixed permission sets.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.