TechKnowSurge
CompTIA Security+ 4.6 NIST 800-53 AC-3
TechKnowSurge Catalog Interactives Which Access Control Model?
InteractiveSecurityFree

Which Access Control Model?

DAC, MAC, RBAC, rule-based, ABAC or risk-based? Name the access control model behind each access decision.

⚑ Complete this interactive to capture a CTF flag worth 5 points.

About this interactive

The Access Control Models lesson covers six ways to decide who gets in. Discretionary (DAC): the owner of a resource decides. Whoever holds full rights on a folder can share it with others at their own discretion. Mandatory (MAC): users have no say. In Security+ terms, an administrator gives each resource a security label (such as confidential or secret) and each user a clearance, and the system compares the two; nobody can pass access on. One correction: the video's example of MAC is a team that has to ask IT or its lead for access. The point of MAC is not who you ask but that access follows labels and clearances that the users cannot change. Role-based (RBAC): permissions go to a role, and people are put in roles. Move someone out of the role and the access goes with it. The lesson calls it the most common choice. Rule-based: the same rules apply to every request, whoever sends it, as on a firewall that lets anyone reach the web server on one port and nothing else. Attribute-based (ABAC): access depends on attributes other than the role, such as location, department, manager or device. Risk-based: access changes with the risk of the moment, such as a weak password or an unusual sign-in. Most companies mix models, for example RBAC for staff and rule-based on the firewall. A quick test for each card: what decided this, the owner, a label, a role, a rule for everyone, an attribute, or a risk signal?

What you'll learn

Aligned to

CompTIA Security+
4.6 Given a scenario, implement and maintain identity and access management.
NIST 800-53
AC-3 Access Enforcement

Key terms

Discretionary Access Control
DAC
Discretionary Access Control is an access control model in which resource owners have the authority to grant or revoke access to their own resources, typically implemented through file system permissions and access control lists.
Role-Based Access Control
RBAC
An access control model that assigns permissions based on a user's role within an organization.
Rule-Based Access Control
An access control model that grants or denies access based on a predefined set of rules, such as firewall rules that permit traffic only on specified ports or from specified IP addresses.
Attribute-Based Access Control
ABAC
Attribute-Based Access Control is a fine-grained access control model that makes authorization decisions based on attributes of the user, resource, and environment, enabling complex policy expressions not achievable with role-based models alone.
Risk-Based Access Control
An access control model that makes access decisions dynamically based on the assessed risk level of a user or situation, such as restricting access when password strength is insufficient.
Access Control
A security mechanism that restricts access to resources based on policies, roles, or identity.

Topics

Access Control Access Control Models Interactive Categorize

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →