Authorization Models: RBAC, ABAC, MAC, DAC, and Least Privilege

CompTIA Security+ SY0-701

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

Current Exam Facts and How Security+ Tests Judgment Domain Weighting and an 8-12 Week Study Plan Practice Questions, PBQs, and the Missed-Question Notebook

2 Domain 1: General Security Concepts (12%)

CIA and Non-Repudiation Control Types and Categories with Scenario Classification Security Principles: Least Privilege, Defense in Depth, Secure by Design, and Zero Trust Change Management and Business Impact

3 Domain 1: Identity, Trust, and Cryptography Basics

AAA and IAM Concepts Authentication Factors and MFA Traps Authorization Models: RBAC, ABAC, MAC, DAC, and Least Privilege Cryptography, Hashes, Signatures, PKI, and Certificate Decision Rules

4 Domain 2: Threat Actors, Vectors, and Social Engineering

Threat Actors and Motivations Attack Vectors and Attack Surface Social Engineering Types and Clues Supply Chain and Insider Threat Scenarios

5 Domain 2: Threats, Vulnerabilities, and Mitigations - Attacks

Malware Behaviors and Indicators Credential and Password Attacks Network and Wireless Attacks Application, API, and Cloud Attacks with Mitigation Mapping

6 Domain 2: Threats, Vulnerabilities, and Mitigations - Vulnerabilities

Vulnerability Types and Misconfiguration Vulnerability Scanning and Prioritization Secure Coding and Application Mitigations Remediation, Compensating Controls, and Risk-Based Decisions

7 Domain 3: Security Architecture - Secure Architecture Models

Architecture Models and Trust Boundaries Cloud Shared Responsibility and Service Models Zero Trust, SASE, and SSE Concepts Secure Design Review Scenarios

8 Domain 3: Security Architecture - Network Security Architecture

Segmentation, VLANs, DMZ, and Microsegmentation Firewalls, WAF, IDS, IPS, and Proxies VPN, Remote Access, and NAC Wireless Security and Enterprise Network Design

9 Domain 3 Part C: Data Protection and Resilience

Data Classification and Handling Encryption at Rest, in Transit, in Use, and Key Management DLP, Privacy, and the Data Lifecycle Backups, RTO, RPO, BCP, DR, and Resilience

10 Domain 4 Part A: Secure Operations for Hosts, Cloud, Mobile, and IoT

Endpoint and Server Hardening Cloud, Container, and Virtualization Operations Mobile, BYOD, and MDM Embedded, IoT, OT, and Physical Device Security

11 IAM Operations and Access Control

Provisioning, Deprovisioning, and Access Reviews PAM, JIT, JEA, and Service Accounts Federation, SSO, SAML, OIDC, and OAuth Account Attacks and IAM Monitoring

12 Logging, Monitoring, and Detection

Log Sources and Telemetry SIEM Correlation and Alert Triage SOAR, Playbooks, and Automation Detection Use Cases and False-Positive Handling

13 Incident Response

IR Phases and Roles Containment, Eradication, and Recovery Decisions Communication, Escalation, Legal, and Regulatory Considerations Post-Incident Lessons Learned and Metrics

14 Digital Forensics and Investigation

Evidence Handling and Chain of Custody Disk, Memory, Network, and Log Artifacts Order of Volatility and Acquisition Choices Forensic Reporting and Anti-Forensics Traps

15 Vulnerability, Patch, Asset, and Automation Operations

Asset Inventory and Data Classification in Ops Vulnerability Lifecycle and CVSS/Risk Priority Patch, Change, and Configuration Management Automation, Orchestration, SCAP, and Security Tooling

16 Governance, Policies, and Risk Management

Governance Documents: Policy, Standard, Procedure, and Baseline Risk Register and Risk Treatment Quantitative/Qualitative Risk and BIA Exceptions, Acceptance, Ownership, and Reporting

17 Third-Party Risk, Compliance, and Privacy

Vendor Risk Lifecycle and Agreements Due Diligence, Questionnaires, and Monitoring Privacy Concepts and Data Rights Compliance Reporting and Consequences

18 Audits, Penetration Testing, and Awareness

Internal and External Audits and Evidence Penetration Test Types and Rules of Engagement Security Awareness, Training, and Phishing Metrics Personnel and Physical Security Program Controls

19 Final Review and PBQ Labs

PBQ Workflow and Timing Ports, Protocols, and Acronyms High-Yield Tables Firewall, IAM, Log, and Risk PBQ Mini-Labs Final 7-Day Review Plan Mixed Exam Strategy and Missed-Question Remediation

Authorization Models: RBAC, ABAC, MAC, DAC, and Least Privilege

Key Takeaways Explain This Topic AI

Authorization decides what an authenticated subject may access; it is separate from a successful login.

RBAC grants permissions through roles/groups; ABAC evaluates attributes such as department, device, time, and data label.

MAC is centrally enforced with labels and clearances; DAC lets the resource owner grant access at their discretion.

Least privilege, need-to-know, separation of duties, and just-in-time access shrink the blast radius of a breach.

Permission creep is the classic scenario clue after transfers, projects, and emergency access that was never removed.

Last updated: June 2026

Authentication Ends, Authorization Begins

Authentication says the user is who they claim to be . Authorization says what that proven user may do . A subject can authenticate perfectly and still be denied because the requested action falls outside policy. SY0-701 tests four core access-control models plus rule-based access, and you must map a scenario's wording to the right one.

• Model How access is decided Best clue word
• RBAC (Role-Based) Permissions come from job roles or groups analyst role, payroll role, admin role

ABAC (Attribute-Based) A policy engine evaluates multiple attributes department, data label, device health, location, time

MAC (Mandatory) A central authority enforces labels and clearances classified, clearance level, mandatory label

• DAC (Discretionary) The resource owner grants access file owner shares a folder
• Rule-Based Access follows explicit, predefined rules firewall ACL, time-of-day rule

A frequent trap: RBAC and rule-based both abbreviate awkwardly, but RBAC ties to roles while rule-based ties to conditions like an ACL. MAC is the strict, non-negotiable model associated with government clearances; the owner cannot override the label.

The Least-Privilege Family

Least privilege is the umbrella; the exam expects you to distinguish its relatives.

• Principle Meaning Scenario clue
• Least privilege Grant only the access required for the task read-only access for reporting
• Need-to-know Access only when a specific business need exists investigator sees only assigned cases
• Separation of duties (SoD) Split a sensitive task across people one requests payment, another approves
• Just-in-time (JIT) access Grant elevated rights only briefly admin rights expire after the change window

Privileged Access Management (PAM) Control and monitor powerful accounts credential checkout, vaulting, session recording

Separation of duties prevents one person from completing a fraud end-to-end; dual control and mandatory vacations support it by forcing a second pair of eyes. Need-to-know is narrower than least privilege: you may have a clearance level yet still be denied a specific file because you have no business reason to see it.

Choosing the Right Model

Match the wording precisely. RBAC is efficient when access maps cleanly to a job. ABAC is flexible when the decision depends on context and combines several signals. MAC is rigid and label-driven. DAC is flexible but sprawls because owners share freely.

• Scenario Best fit Reason
• All help desk staff need identical ticket permissions RBAC One role maps to the job function

Payroll files reachable only from managed devices, in business hours, when labeled internal ABAC Several attributes drive one decision

• A classified file requires a matching clearance label MAC Central labels and clearances control access
• A project owner shares read access to a document DAC The owner chooses who gets in
• Inbound traffic blocked unless a port rule allows it Rule-based A predefined condition decides

The ABAC tell is multiple attributes in one sentence (role and device and time and label). If you only see a single job title driving access, it is RBAC.

Trap Callout: Admin Convenience Is Not Least Privilege

If a user must restart one service, full local administrator on the whole server is excessive. Prefer a narrowly scoped permission, a delegated service-management role, or a JIT privileged session that expires.

Permission Creep, Zero Trust, and a Scenario

Permission creep (privilege creep) is the steady accumulation of rights a user no longer needs after transfers, projects, and emergency grants. The countermeasure is periodic access recertification plus automated deprovisioning. This concept underpins Zero Trust , which assumes no implicit trust and re-checks the policy on every request rather than once at login.

Scenario Walkthrough

A developer is temporarily pulled in to investigate a production outage. The weak answer adds them permanently to the production admin group. The strong answer grants time-limited access through PAM with approval, MFA, session logging, and automatic removal when the work ends, satisfying least privilege and leaving an audit trail.

Quick Drill

• Clue Answer
• Access follows the job title only RBAC
• Access depends on role, classification, device posture, and time ABAC
• Data owner shares access with a coworker DAC
• Labels and clearances decide access MAC
• Old access lingers after a transfer Permission creep
• Elevated rights expire after a change window JIT access
• One person cannot both create and approve a payment Separation of duties
• Cleared user still denied a file with no business reason Need-to-know

A closing nuance the exam likes: implicit deny is the safe default that should sit at the end of any rule set, so anything not explicitly permitted is blocked. Pair that with least privilege and recertification and you cover the three concepts examiners most often combine in a single authorization scenario.