System Administrator Government off-the-Shelf Applications (SAGA) Practice Exam

Access control models determine how permissions are granted. In RBAC, access is granted based on the roles a user has; those roles carry a set of permissions, so assigning a role effectively grants all those rights. In ABAC, decisions are made by evaluating attributes of the user (and often the resource, action, and environment) against defined policies. This lets access be controlled dynamically and contextually, not just by static roles.

Why this answer fits best: it correctly describes RBAC's role-based grants and ABAC's attribute-driven, policy-based decisions, and it highlights ABAC’s finer granularity and ability to apply rules based on context. In SAGA environments, this means you can enforce least privilege with more nuanced conditions—like time, location, or resource sensitivity—beyond what fixed roles alone offer.

The other statements don’t fit: ABAC isn’t limited to time constraints, ABAC is not obsolete, and RBAC and ABAC are not identical. In practice, many systems combine both approaches to get baseline role-based access plus attribute-driven refinements.