SSCP Access Controls Practice Question
A security team is designing an access control system for a research facility. They need a model that supports fine-grained, dynamic access decisions based on user department, project assignment, time of day, and the sensitivity of the resource. The model must also allow policies to be expressed in a human-readable language and evaluated at runtime. Which access control model best fits these requirements?
⚠ Common exam trap
Test-takers frequently confuse RBAC's role assignments with ABAC's dynamic attribute evaluation, overlooking that only ABAC can incorporate environmental conditions like time of day at runtime.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attribute-based access control (ABAC)
Attribute-based access control (ABAC) is designed to evaluate multiple attributes—user, resource, and environmental—at runtime, enabling dynamic and fine-grained decisions. It supports policy languages such as XACML, which are human-readable. RBAC, MAC, and DAC do not offer this combination of dynamic attribute evaluation and expressive policy language, so ABAC is the correct choice.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Attribute-based access control (ABAC)
Why this is correct
ABAC evaluates attributes of subjects, objects, and the environment to make access decisions. It can incorporate department, project, time of day, and resource sensitivity dynamically. Policies can be written in languages like XACML, which are human-readable. This model provides the fine-grained, runtime evaluation required, making it the best fit for the research facility's needs.
- ✗
Role-based access control (RBAC)
Why it's wrong here
RBAC assigns permissions to roles, which are then assigned to users. While it can support department and project assignments, it does not natively evaluate dynamic conditions like time of day or resource sensitivity at runtime. RBAC policies are static and role-centric, lacking the fine-grained, attribute-driven dynamism required here, so it is not the best fit.
- ✗
Mandatory access control (MAC)
Why it's wrong here
MAC uses fixed security labels and clearances, and access is determined by label comparison. It does not support dynamic attributes such as time of day or project assignment, nor does it allow human-readable policy languages. MAC is rigid and label-based, making it unsuitable for the flexible, context-aware access decisions described in the scenario.
- ✗
Discretionary access control (DAC)
Why it's wrong here
DAC allows resource owners to set permissions, but it does not support dynamic, attribute-based decisions or human-readable policy languages. Access is typically based on identity and owner discretion, not on time, project, or sensitivity attributes. DAC lacks the granularity and runtime evaluation needed, so it fails to meet the scenario's requirements.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.