SSCP Access Controls Practice Question
An organization uses ABAC to control access to a document. Which attribute combination would be used to allow access only during business hours from a managed device?
⚠ Common exam trap
The trap is confusing ABAC with RBAC — candidates pick role-based options (role + classification) because they look security-relevant, but ABAC specifically requires environmental and device attributes to enforce context-aware conditions like time and device posture.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
User identity, time of day, and device compliance status
ABAC (Attribute-Based Access Control) evaluates policies against attributes of the subject, resource, action, and environment. To allow access only during business hours from a managed device, the policy must combine a time-of-day environmental attribute with a device compliance attribute, plus the user identity to identify the subject. Option B lists exactly these three: user identity, time of day, and device compliance status.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
User department and document creation date
Why it's wrong here
Department and creation date describe organisational grouping and when the document was made, providing no temporal or device-posture input. These suit records-retention or departmental rules, and would be correct if access depended on the user's team and the document's age.
- ✓
User identity, time of day, and device compliance status
Why this is correct
User identity, time of day, and device compliance status map directly onto ABAC's three attribute categories: subject, environmental, and resource/device. Time of day satisfies the business-hours constraint, while device compliance status enforces the managed-device requirement, so the policy evaluates all three conditions together before granting document access.
- ✗
User role and document classification
Why it's wrong here
Role and classification express who the user is and how sensitive the document is, but neither supplies a clock value or device-management state. Such pairings fit clearance-style decisions, and would be correct if access hinged on seniority and data sensitivity rather than time and endpoint.
- ✗
Document owner and file size
Why it's wrong here
Owner and file size carry no time-of-day or device-posture values, so neither condition in the request can be evaluated. These attributes suit content-ownership or storage-based rules, and would be the right choice if access depended on who owns the document or how large it is.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
One of 971 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.