At a bank, the teller job name is not enough to open a drawer: policy also requires the matching branch attribute, a managed device, and business hours. Which access model is this?
Select an answer to reveal the explanation.
Short Explanation
A job title on the badge is only one line on a form that also asks where you are, what you carry, and what time it is. You need the teller role plus branch, managed device, and business hours before the drawer opens. The trap is stopping at the job name, a coworker's grant, or military-style labels.
Full Explanation
Attribute-based access control evaluates a set of attributes together, not a single job name. This drawer policy requires the teller role, the branch attribute, a managed device, and business hours, so the decision uses that combination. Attribute-based access requiring the teller role, the branch, a managed device, and business hours is the model that fits. Role-based access that treats the teller job name as the only requirement for opening the drawer stops at the job, and the policy explicitly says the job name is not enough. Discretionary sharing that lets a coworker grant the drawer without the branch, device, or hours checks is an owner-style grant, not a policy that tests branch, device, and hours. Mandatory access control that decides the drawer from military-style labels placed on documents uses a label scheme, and the scenario lists branch, device, and hours rather than military labels. On the exam, one attribute from the set can show up in another model, and the model to name is the one that requires the attributes together. In operations, test a teller on the right role but the wrong branch, or on an unmanaged device, and confirm the drawer stays closed.