Which statement correctly differentiates RBAC and ABAC in access control?

Which statement correctly differentiates RBAC and ABAC in access control?

• A. RBAC uses attributes and rules; ABAC assigns permissions by role.
• B. RBAC uses context to grant access; ABAC defines permissions by organization unit.
• C. RBAC assigns permissions by user identity only; ABAC uses access time.
• D. RBAC assigns permissions by role; ABAC uses user attributes and context to grant access.

Answer: (D)

RBAC assigns permissions by role, while ABAC makes decisions based on attributes and context. In RBAC, you define roles (like employee, manager, auditor) and attach a set of permissions to each role. Users gain access by being assigned one or more roles, so changing access means changing role memberships. This works well when job functions are stable and access can be grouped into clear roles. In ABAC, access decisions depend on attributes of the user (such as department or clearance), the resource (data sensitivity), the action (read, write), and the environment or context (time of day, location). Policies combine these attributes to grant or deny access, enabling fine-grained and context-aware control. ABAC can express more nuanced rules, like allowing a read only during business hours from inside the corporate network, which RBAC alone can’t capture as naturally. So the statement that best differentiates the two is that RBAC assigns permissions by role, while ABAC uses user attributes and context to grant access.

RBAC assigns permissions by role, while ABAC makes decisions based on attributes and context. In RBAC, you define roles (like employee, manager, auditor) and attach a set of permissions to each role. Users gain access by being assigned one or more roles, so changing access means changing role memberships. This works well when job functions are stable and access can be grouped into clear roles.

In ABAC, access decisions depend on attributes of the user (such as department or clearance), the resource (data sensitivity), the action (read, write), and the environment or context (time of day, location). Policies combine these attributes to grant or deny access, enabling fine-grained and context-aware control. ABAC can express more nuanced rules, like allowing a read only during business hours from inside the corporate network, which RBAC alone can’t capture as naturally.

So the statement that best differentiates the two is that RBAC assigns permissions by role, while ABAC uses user attributes and context to grant access.