RBAC vs ABAC vs DAC: Distinguishing Access Control Models Quiz

Explore the differences and features of RBAC, ABAC, and DAC access control models with this quiz designed for security professionals. Enhance your understanding of crucial security testing concepts and choose the right model for specific scenarios in access management.

1. Key Differentiator in Access Control Models

   Which characteristic best distinguishes Attribute-Based Access Control (ABAC) from Role-Based Access Control (RBAC) and Discretionary Access Control (DAC) when granting user permissions?

   1. ABAC uses policies based on user, resource, and environment attributes.
   2. ABAC assigns permissions purely through job roles.
   3. ABAC allows resource owners full control over access rights.
   4. ABAC requires two-factor authentication for all actions.

   Explanation: ABAC grants access by evaluating attributes related to users, resources, and the environment, often following complex policy rules. RBAC, on the other hand, assigns permissions based on predefined roles within an organization. DAC gives resource owners authority to manage access, while ABAC does not rely on owner discretion or roles. Two-factor authentication refers to authentication, not to the fundamental principle behind ABAC.

2. Scenario-Based Access Control Selection

   Given a scenario where a user can share a document with any other user and even modify permissions, which access control model does this scenario best exemplify?

   1. Discretionary Access Control (DAC)
   2. Role-Based Access Control (RBAC)
   3. Mandatory Access Control (MAC)
   4. Attribute-Based Access Control (ABAC)

   Explanation: DAC lets individual users, or resource owners, decide who can access their resources and adjust permissions, matching the scenario where users can directly share documents and modify access. RBAC restricts permissions based on roles, not user discretion. MAC is centrally controlled and does not permit user-driven sharing. ABAC could allow sharing based on attributes but does not inherently give ownership control to users.

3. Complexity Comparison

   Which statement best describes the complexity of policy administration in ABAC compared to RBAC?

   1. ABAC policies are usually more complex because they evaluate multiple attributes.
   2. ABAC policies are always less complex due to fewer rules.
   3. RBAC and ABAC have identical administrative complexity.
   4. RBAC always requires environmental attributes, increasing its complexity.

   Explanation: ABAC often requires policies to process numerous attributes (such as time, location, and resource type), making its administration potentially more complex than RBAC, which relies primarily on associating users with roles. Claiming that ABAC is always less complex is incorrect; complexity typically increases with flexible attribute handling. RBAC does not require environmental attributes by default, and the complexity between the two models is not identical.

4. Role of Roles in Access Control

   In which access control model are permissions ideally organized according to organizational job functions such as 'manager', 'analyst', or 'assistant'?

   1. Role-Based Access Control (RBAC)
   2. Attribute-Based Access Control (ABAC)
   3. Rule-Based Access Control
   4. Discretionary Access Control (DAC)

   Explanation: In RBAC, permissions are grouped according to roles that correspond to job functions, simplifying administration across the organization. ABAC focuses instead on dynamic attribute evaluations, not static roles. Rule-Based Access Control uses rules rather than roles, and DAC is based on resource ownership rather than job-function organization.

5. Limitations of DAC

   What is a primary security concern associated with Discretionary Access Control (DAC) compared to RBAC and ABAC?

   1. DAC allows users to unintentionally grant access to unauthorized individuals.
   2. DAC prevents sharing of resources among users.
   3. DAC automatically enforces policies based on time of access.
   4. DAC offers no support for environment-based policies.

   Explanation: A notable concern with DAC is that resource owners may inadvertently grant access to malicious or unauthorized users, potentially leading to data leakage. Unlike this, RBAC and ABAC provide more controlled, policy-driven mechanisms for managing permissions. DAC does allow sharing, so the second option is incorrect. Automatic enforcement based on time or environment is characteristic of ABAC, not DAC.