A company requires that access to records depend on the user's department, the record's data classification and whether the request occurs during business hours. Which access control model best fits this requirement?
Select an answer to reveal the explanation.
Short Explanation
When the decision depends on several facts at once, who you are, what the data is, and what time it is, you want ABAC. It evaluates attributes against a policy at the moment of the request. RBAC is the trap; it looks only at your role and can't easily account for the time of day or the record's label.
Full Explanation
Attribute-based access control makes authorization decisions by evaluating policies against attributes of the subject, such as department, clearance or job title; the resource, such as data classification or owner; the action; and the environment, such as time of day, location or device. A rule like allowing finance users to read confidential finance records only during business hours combines all three attribute types in one policy, which is exactly the ABAC pattern. Role-based access control grants permissions through role membership; it can model the department as a role, but conditions on record classification and time of day would require many narrowly defined roles or extra logic outside the model. Discretionary access control lets resource owners grant access at their own discretion, which does not provide centrally enforced, attribute-driven policy. Mandatory access control enforces system-assigned labels and clearances, such as classification levels, but it is not designed around conditions like department membership combined with time-of-day windows. Exam caveat: ABAC and RBAC are often combined, using roles as one attribute among others in an ABAC policy. Operational check: write test cases for each attribute combination, including a request outside business hours, and confirm the policy decision point allows or denies as specified.