ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question

Attribute-Based Access Control evaluates attributes about the subject (e.g., role=physician, userID), the object (e.g., attendingPhysicianID on the record), and the requested action (read or write). A policy can therefore permit read access to all users whose role attribute equals physician while restricting write access to those whose userID matches the record's attendingPhysicianID. Traditional role-based access control cannot easily express this per-record condition without creating an explosion of roles, discretionary access control would rely on individual users to manage ACLs, and mandatory access control uses fixed classification labels that do not reflect dynamic doctor-patient assignments. Hence, ABAC is the most appropriate choice.