Which statement accurately describes RBAC, ABAC, MAC, and DAC as access-control models?

• A. RBAC assigns permissions by role; ABAC uses attributes; MAC enforces with labels and policies; DAC lets owners grant access. Each differs in granularity and administration.
• B. ABAC uses roles; RBAC uses attributes; MAC is deprecated; DAC uses labels.
• C. RBAC uses labels; ABAC grants by owner; MAC assigns by role; DAC uses attributes.
• D. RBAC uses owner grant access; ABAC uses roles; MAC enforces with arbitrary labels; DAC uses policies. (Incorrect)

Answer: (D)

The idea being tested is how each access-control model determines who can access what and who controls those permissions.

RBAC assigns permissions by role, and users gain access by being assigned to roles. This reflects organizational structures and makes administration easier because you manage permissions at the role level rather than for every individual.

ABAC makes decisions based on attributes: characteristics of the user, the resource, and the environment. Policies evaluate these attributes to grant or deny access, allowing fine-grained and context-aware control.

MAC uses centralized, mandatory labels and policies to enforce access. Users and resources have security classifications, and access decisions are determined by these labels and the system-wide rules, with little to no discretionary control by individual owners.

DAC lets owners control access to their resources, granting and revoking permissions at their discretion. This is flexible but can lead to weaker security controls if owners are not diligent.

The statement that best captures these descriptions is the one that says RBAC uses roles to grant permissions, ABAC uses attributes, MAC enforces with labels and policies, and DAC lets owners grant access. Dissenting from this, the other description swaps or misstates the fundamental mechanics (e.g., who controls access, what is used to decide access), so it isn’t accurate.