Access Control Models
Four models, and exam questions separate them by one question: who decides who gets in. The authentication factor tables underneath are the other half, because multifactor questions turn on whether two factors are actually different types.
Access Control Models · firsttry.app/cheatsheets/access-control-models · original reference written from published exam objectives. Not affiliated with any certification body.
The models
| Model | Who decides | Typical use |
|---|---|---|
| DAC | The data owner | File shares, most operating systems |
| MAC | The system, from labels | Military and classified environments |
| RBAC | Assignment to a role | Enterprise directories, most business apps |
| ABAC | Policy over attributes | Cloud, context-aware access |
| Rule-based | Static rules on the resource | Firewall and ACL entries |
| Least privilege | Not a model, a principle | Applies inside every model above |
Authentication factors
| Factor | Meaning | Examples |
|---|---|---|
| Something you know | Knowledge | Password, PIN, security question |
| Something you have | Possession | Token, smart card, phone with an authenticator |
| Something you are | Inherence | Fingerprint, face, iris, voice |
| Somewhere you are | Location | GPS, IP geolocation, network segment |
| Something you do | Behaviour | Typing rhythm, gait, signature dynamics |
Multifactor: what counts
| Combination | Is it MFA | Why |
|---|---|---|
| Password plus PIN | No | Both are knowledge |
| Password plus TOTP app | Yes | Knowledge plus possession |
| Password plus SMS code | Yes, weakly | Possession, but SIM swapping applies |
| Smart card plus PIN | Yes | Possession plus knowledge |
| Fingerprint plus face | No | Both are inherence |
| Password plus security question | No | Both are knowledge |
AAA and biometric measures
| Term | What it means |
|---|---|
| Authentication | Proving who you are |
| Authorization | What you may do once proven |
| Accounting | Recording what you did |
| RADIUS | AAA protocol, UDP, encrypts the password only |
| TACACS+ | AAA protocol, TCP, encrypts the whole payload, separates the three A's |
| Kerberos | Ticket-based authentication, port 88, time sensitive |
| False acceptance rate (FAR) | Wrong person accepted. The security risk |
| False rejection rate (FRR) | Right person rejected. The usability cost |
| Crossover error rate (CER) | Where FAR and FRR meet. Lower is a better system |
Exams covered
Now test yourself
Memorizing a table is a start. Practice questions are what make it stick, and every answer carries the full explanation.