In ABAC, which elements are used to determine access?

• A. Environment only determines access.
• B. Attributes such as user, resource, action, and environment determine access.
• C. Role alone determines access.
• D. Time of day only determines access.

Answer: (B)

In ABAC, access decisions are driven by attributes attached to the user (subject), the resource (object), the action being requested, and the context or environment. When a request comes in, a policy engine compares these attributes against defined policies. If the attributes satisfy the conditions in a policy, access is granted; if not, it’s denied. This approach lets you express nuanced rules, such as “allow this user to perform that action on this resource only if they belong to the right department, during business hours, from an internal network,” using multiple attributes at once.

That’s why the best choice is to say that attributes such as user, resource, action, and environment determine access. It isn’t limited to one factor like time, or to a single role, or to the environment alone; ABAC evaluates a combination of attributes to make a decision.