What is ABAC, and when is it preferred over RBAC in ISSAP designs?

• A. Attribute-Based Access Control uses user, resource, and environmental attributes to make dynamic access decisions; preferred when fine-grained, context-aware authorization is required.
• B. Attribute-Based Access Control relies on roles to grant permissions; preferred when simple role assignments are sufficient.
• C. Attribute-Based Access Control is a deprecated model; preferred only in legacy systems.
• D. Attribute-Based Access Control concerns encryption keys; preferred for high-security networks.

Answer: (B)