SY0-701 Question 358
Single answerAccess controls: Mandatory , Discretionary , Role-based , Rule-based , Attribute-based , Time-of-day restrictions , Least privilegeA hospital is deploying a new electronic health record (EHR) system. Nurses must be able to view and update records only for patients assigned to their department during their scheduled shifts. Physicians must retain broader access based on their job function, and researchers may access only de-identified records after approval. The security team wants an access control model that can evaluate multiple conditions such as job role, department, shift time, and data classification in a single policy decision while still supporting least privilege. Which access control model BEST fits this requirement?
- A
Discretionary access control (DAC), because record owners can decide who gets access to each patient file
- B
Mandatory access control (MAC), because centrally assigned labels alone can enforce all business requirements without additional attributes
- C
Role-based access control (RBAC), because assigning users to roles is sufficient to enforce department, shift, and data sensitivity requirements
- D
Attribute-based access control (ABAC), because policies can evaluate subject, object, and environmental attributes such as role, department, data type, and time of day
Show answer and explanation
Correct answer: D
Explanation
The best answer is Attribute-based access control (ABAC). The scenario requires decisions based on multiple factors at once: the user's role, department assignment, current shift time, and the type or classification of the data being accessed. ABAC is specifically intended for this kind of fine-grained, context-aware access decision. RBAC would help with broad job-function access, but by itself it does not fully address dynamic conditions such as time-of-day restrictions or whether records are de-identified. MAC is centrally controlled and classification-driven, but it is not the best fit when access must also adapt to operational context. DAC is the least appropriate because it relies on data owners to grant access and is harder to manage consistently in regulated environments. This aligns with common security architecture guidance, including NIST concepts around logical access control and authorization models, where ABAC is recommended for complex policy enforcement using subject, object, action, and environmental attributes. The least privilege principle is also better supported by ABAC because access can be narrowly scoped to exactly what is needed under the current conditions.
- A. Incorrect.
Incorrect. DAC allows object owners to grant access, which is too decentralized for a hospital trying to enforce consistent enterprise policies. It also does not inherently evaluate multiple contextual conditions like scheduled shift time or data classification. A candidate might choose this because departments often 'own' their data, but DAC is generally less suitable where strict centralized control and least privilege are required.
- B. Incorrect.
Incorrect. MAC uses centrally controlled labels and classifications, which is useful in highly regulated environments, but MAC by itself is not the best fit for this scenario because the requirement includes several dynamic factors beyond classification, such as department assignment and shift time. Someone may choose MAC because healthcare data is sensitive, but MAC focuses primarily on label-based decisions rather than rich contextual policy evaluation.
- C. Incorrect.
Incorrect. RBAC is useful for granting permissions based on job function, such as nurse, physician, or researcher, and it is commonly used in enterprises. However, RBAC alone does not natively account for changing environmental conditions like time-of-day restrictions or other attributes such as whether a record is de-identified. A candidate might select this because job role is clearly relevant, but the scenario requires more granular, context-aware decisions than RBAC alone typically provides.
- D. Correct.
Correct. ABAC is designed to make authorization decisions using multiple attributes, including subject attributes (for example, role or department), object attributes (for example, whether a record is de-identified or sensitive), and environmental attributes (for example, time of day or current shift). This makes it the best choice for enforcing least privilege in a complex real-world healthcare workflow where access depends on several conditions simultaneously.