How do RBAC and ABAC differ in granting access?

• A. RBAC relies on user identity alone; ABAC relies on organizational policy.
• B. RBAC uses attributes to grant access; ABAC uses roles.
• C. RBAC assigns permissions by role; ABAC uses attributes (user, resource, action, environment) to grant access.
• D. RBAC and ABAC are the same model.

Answer: (C)

Access decisions difference: RBAC grants permissions by assigning them to roles, and users receive those permissions by being given a role. This makes management straightforward—change a user’s access by moving them to a different role—but it can be less flexible for context-specific needs. ABAC, on the other hand, uses attributes about the user, the resource, the action, and the environment to decide whether to allow access. Policies evaluate these attributes to grant or deny permission, enabling fine-grained, context-aware control that can adapt to complex situations.

So, RBAC assigns permissions through roles, while ABAC uses attributes (user, resource, action, environment) to determine access. For example, RBAC might let anyone with the Finance Clerk role read invoices, whereas ABAC could permit reading an invoice only if the user’s department matches and the request is made during business hours, demonstrating more nuanced control.