200-201 Question 68
Select 4A cybersecurity analyst is configuring access control for a sensitive database containing customer data. The analyst decides to implement Attribute-Based Access Control (ABAC). Which of the following factors can be used as attributes in ABAC to enforce access permissions?
- A
The geographic location of the user accessing the database
- B
The time of day when the access request is made
- C
The user's role within the organization, such as 'Manager' or 'Analyst'
- D
The user's password used to log into the system
- E
The type of device being used to access the database, such as a corporate laptop or a personal smartphone
Show answer and explanation
Correct answers: A, B, C, E
Explanation
Attribute-Based Access Control (ABAC) uses a wide range of attributes, such as user identity, device type, location, and environmental factors, to make access control decisions. This provides a more flexible and granular approach to access management compared to traditional role-based access control. In this scenario, geographic location, time of access, user roles, and device type are all valid attributes for ABAC, whereas passwords are part of the authentication process and not relevant to ABAC.
- A. Correct.
Correct: Geographic location is a valid attribute in ABAC, as it can be used to determine access permissions based on where the user is physically located.
- B. Correct.
Correct: Time-based attributes can be used in ABAC to restrict access during specific hours or days.
- C. Correct.
Correct: User roles are commonly used as attributes in ABAC to define access permissions based on organizational responsibilities.
- D. Incorrect.
Incorrect: A password is considered an authentication factor, not an ABAC attribute. ABAC focuses on contextual and environmental attributes.
- E. Correct.
Correct: The type of device being used is a valid ABAC attribute, as it can influence access permissions based on device security or compliance.