hardMultiple ChoiceObjective-mapped
ABAC Conjunctive Conditions: How AND Logic Works in Attribute-Based Access Control
An organization uses attribute-based access control (ABAC) for its cloud storage. The policy states that a user can read a document only if the user’s department attribute matches the document’s department attribute AND the current time is within business hours (9AM-5PM). A user from Engineering tries to read a document classified for Engineering at 8:55 AM. What is the expected result?
Quick Answer
The answer is access denied because the time condition is false. In an ABAC policy with multiple conditions and AND logic, every attribute rule must evaluate to true for access to be granted; this is known as a conjunctive condition. Here, even though the user’s Engineering department matches the document’s department, the request at 8:55 AM falls outside the required business hours of 9AM–5PM, making the time condition false and thus denying access. On the Systems Security Practitioner SSCP exam, this scenario tests your understanding of how attribute-based access control enforces policy through logical operators, often appearing in questions that combine user, resource, and environmental attributes. A common trap is assuming a single matching attribute is sufficient, but the AND operator demands all conditions be satisfied. Remember the memory tip: “AND means all must stand—one false, and access is banned.”
⚠ Common exam trap
The trap here is that candidates focus on the department match and overlook the conjunctive AND logic, assuming a single matching attribute is sufficient for access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Access denied because the time is outside business hours
The ABAC policy requires both conditions to be true: department match AND time within business hours (9AM-5PM). At 8:55 AM, the time condition is false, so access is denied regardless of the department match. This is a classic example of a conjunctive (AND) policy in ABAC where all attributes must satisfy the rules.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Access granted because the department matches
Why it's wrong here
The time condition is not satisfied.
- ✗
Access denied because the department does not match
Why it's wrong here
Department matches.
- ✗
Access granted because the user is in Engineering
Why it's wrong here
Both conditions must be true.
- ✓
Access denied because the time is outside business hours
Why this is correct
8:55 AM is before 9 AM, so the time condition fails.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 920-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SSCP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An organization implements an attribute-based access control (ABAC) system with the following policy: if user.role == 'doctor' and resource.type == 'patient_record' and environment.time between 08:00-18:00 then permit. A doctor tries to access a patient record at 20:00. What is the result?
hard- A.Permit
- B.Indeterminate
- C.Not applicable
- ✓ D.Deny
Why D: The ABAC policy requires the environment.time to be between 08:00 and 18:00 for access to be permitted. Since the doctor attempts access at 20:00, which falls outside this time window, the condition is not met, and the policy evaluates to 'deny' by default in a closed-system ABAC model. The correct result is Deny (option D).
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.