Define RBAC and ABAC and give an example scenario in data exchange.

• A. RBAC grants permissions by role; ABAC uses attributes. Example: allow read if user.role=analyst or if user.department=legal and clearance=confidential.
• B. ABAC uses attributes.
• C. RBAC and ABAC are the same; Example meaningless.
• D. RBAC grants reads regardless; ABAC denies all.

Answer: (A)

RBAC grants permissions by role; ABAC uses attributes. In practice, RBAC assigns users to roles and each role has a defined set of permissions, so access depends on the user’s role. ABAC makes decisions based on attributes of the user, the resource, the action, and the environment, allowing more fine-grained and dynamic control.

A data exchange scenario could be: allow read if the user.role is analyst, or if the user.department is legal and the user.clearance is confidential. This illustrates RBAC-style access for a role and ABAC-style checks using additional attributes like department and clearance.

The other options misstate either the concept or the relationship between RBAC and ABAC, or rely on an incomplete description.