What is the difference between RBAC and ABAC in MDC3 IAM?

What is the difference between RBAC and ABAC in MDC3 IAM?

• A. RBAC uses attributes; ABAC assigns permissions by role.
• B. RBAC assigns permissions by role; ABAC uses attributes of user, resource, and context to grant access.
• C. RBAC and ABAC are the same.
• D. ABAC is obsolete.

Answer: (B)

RBAC centers access on roles. Permissions are attached to roles, and a user gains access by being assigned to the appropriate role. ABAC, in contrast, makes decisions based on attributes of the user, the resource, and the context, evaluated against policies to grant or deny access. This allows more granular and dynamic control, because decisions can depend on multiple factors like user department, resource sensitivity, time of day, or location. So RBAC is simpler and role-driven, while ABAC is attribute-driven and policy-based. The other options mix up who holds permissions or suggest obsolescence, which isn’t accurate.

RBAC centers access on roles. Permissions are attached to roles, and a user gains access by being assigned to the appropriate role. ABAC, in contrast, makes decisions based on attributes of the user, the resource, and the context, evaluated against policies to grant or deny access. This allows more granular and dynamic control, because decisions can depend on multiple factors like user department, resource sensitivity, time of day, or location. So RBAC is simpler and role-driven, while ABAC is attribute-driven and policy-based. The other options mix up who holds permissions or suggest obsolescence, which isn’t accurate.