Which policy type restricts user access based on the time of day?

Which policy type restricts user access based on the time of day?

• A. Role-based access control
• B. Time-of-day restrictions
• C. Mandatory access control
• D. Attribute-based access control

Answer: (B)

Time-based controls gate access by the clock, allowing or denying requests depending on when they occur. This policy explicitly uses time-of-day as the condition for authorization, so it’s the clearest way to describe restricting access to specific hours, such as permitting access only during business hours or during a maintenance window. Role-based access control assigns permissions based on a user’s role, not on time. Mandatory access control enforces permissions based on fixed security labels and clearances, not on when access is requested. Attribute-based access control uses various attributes (like user, resource, and environment), and time can be one of those attributes, but the approach described here—restricting access strictly by the time window—directly corresponds to time-of-day restrictions.

Time-based controls gate access by the clock, allowing or denying requests depending on when they occur. This policy explicitly uses time-of-day as the condition for authorization, so it’s the clearest way to describe restricting access to specific hours, such as permitting access only during business hours or during a maintenance window.

Role-based access control assigns permissions based on a user’s role, not on time. Mandatory access control enforces permissions based on fixed security labels and clearances, not on when access is requested. Attribute-based access control uses various attributes (like user, resource, and environment), and time can be one of those attributes, but the approach described here—restricting access strictly by the time window—directly corresponds to time-of-day restrictions.