ISC2 Certified Cloud Security Professional (CCSP) Practice Question

An Attribute-Based Access Control (ABAC) model evaluates attributes about the user, resource, action, and environment each time access is requested. If the IRM engine receives the contractor's engagement_end date as a claim, an ABAC policy can compare that value to the current date, grant view-only rights while the date is still in the future, and automatically deny access (and thus revoke viewing capability) once the date has passed. RBAC relies on static role assignments that must be removed manually, DAC depends on owners editing ACLs, and MAC enforces administrator-defined security labels-not dynamic identity attributes-so none of those models provide the desired automatic, attribute-driven expiration.