Back to Access Control

Attribute-Based Access Control

5 minutes 5 Questions

Attribute-Based Access Control (ABAC) is a security model that uses dynamic and flexible policies to determine access permissions. In ABAC, access control decisions are made based on attributes of the user, object, and the environment, as well as predefined rules expressed in a policy. Attributes c…

Test mode:
Start practice test
CISSP - Attribute-Based Access Control Example Questions

Test your knowledge of Attribute-Based Access Control

Question 1

A company's ABAC policy allows project managers to access project documents if the project's budget is under their approval limit. What attribute is this policy based on?

Correct Answer: Approval Limit

In this scenario, the access control policy is based on the approval limit attribute, as project managers can only access documents if the project's budget is under their approval limit. The other answers refer to other attributes not mentioned in this scenario.

Question 2

In an ABAC system, a user's request to edit a confidential document is granted based on their department, their security clearance, and the current threat level. What kind of policy decision does this represent?

Correct Answer: Context-aware dynamic access control

The question describes a scenario in which access control is determined by multiple attributes such as the user's department, security clearance, and the current threat level. This corresponds to an Attribute-Based Access Control (ABAC) system. ABAC policies use dynamic aspects, such as threat level, in conjunction with static attributes like department and clearance to make access decisions. Therefore, 'Context-aware dynamic access control' is the correct answer because it encompasses the use of both static and dynamic attributes to control access at any given time. 'Role-based static permission assignment' is incorrect because role-based access control (RBAC) primarily relies on the roles or positions within an organization to determine access and does not typically factor in dynamic context such as the current threat level. 'Mandatory fixed attribute regulation' is not the correct answer as it suggests a rigid control mechanism such as Mandatory Access Control (MAC) where access decisions are based on fixed attributes and classification levels, not taking dynamic context into account. 'Discretionary access control based on ownership' is incorrect because it emphasizes access control at the discretion of the resource owner, which is not the scenario described. Discretionary Access Control (DAC) typically does not involve multi-faceted attributes or environmental factors as a basis for decision-making.

Question 3

In an organization, sensitive documents are restricted to access by users from particular departments. What attribute is this policy based on?

Correct Answer: Department

In this scenario, the access control policy is based on the department attribute, as only users belonging to specific departments can access sensitive documents. The other answers refer to other attributes which are not mentioned in this scenario.

More Attribute-Based Access Control questions
12 questions (total)
Start 12 question test