Access control models are one of those objectives that look like pure memorisation and then turn up as a scenario where four acronyms all sound defensible. DAC, MAC, RBAC, ABAC, rule-based. Everyone learns the expansions. Then the question describes a company doing something perfectly reasonable and asks which model that is. So which is it? The expansions do not help you here, because every one of them is about controlling access.
There is one question that sorts them, and it has nothing to do with what the model does. Ask who or what gets to make the decision, and whether anybody is able to overrule it.
DAC: the owner decides
Discretionary means at somebody's discretion, and that somebody is whoever owns the resource. You made the file, so you pick who reads it. Windows NTFS permissions work this way. So do Google Drive share links. Simple enough.
The tell in a scenario is a person granting access to their own stuff without asking anyone. "A user shares a folder with a colleague." That is DAC. Nothing more to it. The security complaint about DAC is baked right into the definition, too, because the decision sits with whoever happens to own the object, and owners can be talked into things.
MAC: the system decides, and the owner cannot override it
Mandatory means the policy is not up for negotiation. Access comes from labels. The resource carries a classification, the subject carries a clearance, and the system compares the two. If your clearance does not reach the label you do not get in, and neither the owner nor your manager is able to hand it over.
Scenario tells: classification levels, clearances, anything that smells of government or defence work, SELinux.
There is a better tell than any of those, though. Did the file owner try to share something and get refused? That is MAC. Under DAC the owner would have succeeded.
RBAC: your job decides
Permissions attach to roles rather than to people. You are in the role, so you inherit the permission set that comes with it. A new nurse starts, gets put in the Nursing role, and can now do everything the last nurse could do.
What is the tell here? A job title or a department doing the work. "Members of the accounting team can access the general ledger." Notice that the permission belongs to accounting and not to a named human. That is also why RBAC is the expected answer on questions about onboarding and offboarding at scale, and on permission creep, since the fix for somebody who has accumulated access across three different jobs is roles.
ABAC: the conditions decide
Attribute based access control evaluates properties at the moment of the request. Department, device, location, time of day. Policies get written as combinations, so a rule might allow finance staff on a corporate device during business hours and nobody else.
This is the model people miss, and the tell is very easy once you have seen it. If the scenario contains a condition that could differ between two requests from the same person, it is ABAC. Same employee, allowed at 10am from the office laptop and denied at 11pm from a personal phone. Nothing about their role moved in those thirteen hours. The attributes did.
Rule-based: one rule set, applied to everybody
The rules here have nothing to do with who you are, and they apply across the board. Firewall access control lists are the everyday example. A packet arrives, the list gets evaluated top down, first match wins, and nobody's job title enters into it anywhere.
This is where the model questions and the network questions meet. It is worth practising the mechanic rather than the definition, because firewall rule ordering is also a favourite performance based question, and the thing that catches people out is not syntax at all. A broad permit sitting above a specific deny means the deny never gets reached. The rule is right there in the config and it may as well not exist. If you want reps on exactly that, I built a free browser based firewall PBQ with no account needed at Security+ PBQ practice. Fair warning, the site is mine.
The distractors that are not models at all
Least privilege, separation of duties and job rotation all show up in the answer options for these questions. They are principles. There is a real difference, and the exam leans on it in order to build distractors that feel correct.
A question asking which access control model is in use has an answer that is one of the five above. One that asks which principle was violated is a different beast wearing similar clothes. So read the stem for the word model. Every time.
The short version
Ask who says yes.
The owner says yes: DAC.
The label says yes: MAC.
The job says yes: RBAC.
The conditions say yes: ABAC.
The rule list says yes: rule-based.
If two options still look right after that, go looking for the override. Whether the owner is able to hand out access separates the first two. Whether the answer changes between two requests from the same person separates the middle two.
Top comments (0)