Which control approach enforces policies based on conditions or rules without considering individual user identity?

• A. Discretionary Access Control
• B. Mandatory Access Control
• C. Attribute-Based Access Control
• D. Rule-Based Access Control

Answer: (D)

This question tests how access decisions are driven by policy rules rather than who the user is. Rule-Based Access Control makes decisions by evaluating a set of conditions or rules—such as time of day, source IP address, or network zone—and grants or denies access based on those rules. The user’s identity isn’t the deciding factor; the rules themselves control the outcome.

That’s why this model best fits “policies based on conditions or rules without considering individual user identity.” By contrast, other models tie access to identity or roles (owner permissions in Discretionary Access Control, security labels in Mandatory Access Control, user attributes in Attribute-Based Access Control, or user roles in Role-Based Access Control), which means the user or their identity does influence access decisions.