thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Commonly confused · Security Fundamentals & Crypto

RBAC vs ABAC: What's the Difference?

RBAC grants permissions based on a user's role, while ABAC evaluates policies that combine attributes of the user, resource, action, and environment such as time, location, or device posture. ABAC is more granular and context aware, but more complex to manage.

Role-Based Access Control (RBAC)

Full definition
vs

Attribute-Based Access Control (ABAC)

Full definition
Role-Based Access ControlAttribute-Based Access Control
Decision basisRole membershipAttributes of subject, object, action, environment
GranularityCoarseFine-grained
Context awarenessMinimalHigh (time, location, device, risk)
ManagementSimple, but prone to role explosionComplex policy authoring
Example ruleNurses can read patient chartsNurses can read charts of patients on their ward during their shift from a managed device
Fits zero trustPartiallyStrongly
Remember it

RBAC asks who you are; ABAC asks who, what, where, when, and how.

Exam tip

If the scenario includes conditions like time of day or geolocation, the answer is ABAC (or rule-based). Role explosion as a problem is a hint that ABAC would help.

Tested on

More Security Fundamentals & Crypto look-alikes