A web application requires multifactor authentication when a user accesses the application from a home office but does not require this when the user is in the office. What access control model is…

Lattice-based access control uses security labels and clearance levels to define subject-to-object access relationships, not contextual factors like network location.

An access control list defines specific permissions for users or groups on resources but does not dynamically adjust authentication requirements based on location or context.

Variable trust access control adjusts security requirements dynamically based on contextual factors such as the user's location, device, or network. In this case, the office network is treated as a higher-trust environment so MFA is not required, while the home office is lower-trust and requires MFA. This model is a core principle of Zero Trust architecture, where trust is never implicit and is always evaluated based on context.

Role-based access control grants permissions based on a user's assigned organizational role, not based on the network location or environmental context from which they connect.