ABAC Policy Evaluator

Evaluate attribute-based access control policies across healthcare, financial services, and cloud infrastructure. For each request, determine the access decision AND identify which attributes are the deciding factors.

What You’ll Practice

• Reading ABACAttribute-Based Access Control — Access decisions based on attributes (user, resource, environment) policies and evaluating them against a set of subject, resource, and environment attributes
• Identifying which specific attributes cause an access decision — not just “allow or deny” but why
• Understanding how environmental context (time, location, device, risk scores) changes access decisions
• Seeing ABACAttribute-Based Access Control — Access decisions based on attributes (user, resource, environment) in action across industries: hospital data, bank transactions, and cloud IAMIdentity and Access Management — Framework for managing digital identities and permissions
• Recognizing emergency overrides and conditional escalation policies

How the Exam Tests This

Objective 4.5 lists ABACAttribute-Based Access Control — Access decisions based on attributes (user, resource, environment) alongside RBACRole-Based Access Control — Permissions assigned to roles, users assigned to roles, DACDiscretionary Access Control — Resource owner controls access permissions, and MACMandatory Access Control — System-enforced access based on security labels. CompTIA tests whether you understand that ABACAttribute-Based Access Control — Access decisions based on attributes (user, resource, environment) evaluates combinations of attributes — not just roles or labels. Expect questions like “Which access control model can restrict access based on time of day and geographic location?” or scenario-based questions where the correct answer requires evaluating multiple attributes simultaneously.

Scoring

Each request is scored on two dimensions: correct access decision (allow/deny) and correct identification of deciding attributes. Both matter — getting the decision right by luck doesn’t demonstrate understanding.