Access Control Models for Security+
Short answer
Access control models determine how authorization decisions are implemented. In an operational IAM scenario, the key is to recognize what drives the decision. If access follows formal labels and clearances, think mandatory access control. If a file owner decides who can read the file, think discretionary access control. If membership in the "Nurses" or "Payroll" role controls access, think role-based access control. If a simple rule blocks all logins outside business hours, think rule-based access control or a time-of-day restriction.
Why it appears on the exam
SY0-701 4.6: Compare mandatory, discretionary, role-based, rule-based, attribute-based, time-of-day, and least-privilege access control models.
Key concepts
Concept 1
Required terms
mandatory access control: an access model where a central authority enforces access based on classifications, labels, or clearance levels that users cannot override. discretionary access control: an access model where the resource owner can decide who receives access to the resource. role-based access control: an access model where access is assigned through job roles or groups. rule-based access control: an access model where access is allowed or denied based on defined system rules.
Example
A government system only allows users with the matching clearance label to open classified records, and users cannot change those labels. This is mandatory access control.
Concept 2
How Access Control Models works
Access control models determine how authorization decisions are implemented. In an operational IAM scenario, the key is to recognize what drives the decision. If access follows formal labels and clearances, think mandatory access control. If a file owner decides who can read the file, think discretionary access control. If membership in the "Nurses" or "Payroll" role controls access, think role-based access control. If a simple rule blocks all logins outside business hours, think rule-based access control or a time-of-day restriction.
Example
A department share lets the folder owner grant read access to a coworker. This is discretionary access control.
Concept 3
Common confusion
Learners often confuse rule-based and role-based access control because both can use groups or policies. Role-based access follows job function; rule-based access follows explicit conditions or system rules. Attribute-based access is broader than a single rule because it can evaluate many attributes together.
Example
A hospital assigns access based on job roles such as nurse, physician, and billing specialist. This is role-based access control.
Concept 4
What to recognize
Match MAC, DAC, RBAC, rule-based access, ABAC, or time-of-day restrictions to scenario details; Identify least privilege as the best principle when excess permissions should be reduced; Explain why a role change should trigger permission reassignment or access review; Recognize when multiple attributes make ABAC a better answer than simple RBAC.
Example
A cloud application allows finance users to approve invoices only from managed devices, during business hours, and when the invoice is assigned to their region. This is attribute-based access control with time and device attributes.
Sample questions
Select an answer to reveal the explanation. For tracked practice and weak-area review, use the Cultiv8 app.
Q1.A security team sees this situation: A government system only allows users with the matching clearance label to open classified records, and users cannot change those labels. Which concept applies?
Q2.A security question includes this clue: A department share lets the folder owner grant read access to a coworker. Which term is being tested?
Q3.A Security+ scenario describes this situation: A hospital assigns access based on job roles such as nurse, physician, and billing specialist. Which answer fits best?
Practice this lesson in Cultiv8
The app adds tracked practice, targeted remediation, saved session history, and future readiness scoring.
Continue in Cultiv8