In ABAC, which factors are used to determine access decisions?

• A. User roles only
• B. Resource ownership only
• C. Environment and resource state only
• D. User attributes, resource attributes, and environment attributes

Answer: (D)

ABAC makes access decisions by evaluating multiple attributes across three areas: who the user is, what the resource is, and the context of the request. User attributes include things like identity, role, department, and clearance. Resource attributes cover properties such as owner, classification, sensitivity, and type. Environment attributes encompass the context of the access request, like time of day, location, network security, and device health.

This combination lets policies specify nuanced rules, such as: a user in a particular role can access certain resources only during business hours on a trusted network, and only if the resource has a matching sensitivity level. That’s why using all three attribute types is the essence of ABAC.

Relying on only one aspect—such as user roles, or ownership, or environmental state alone—fails to capture the full, flexible access control that ABAC aims to provide.