Access Control Models
Four models, and exam questions separate them by one question: who decides who gets in. The authentication factor tables underneath are the other half, because multifactor questions turn on whether two factors are actually different types.
Access Control Models · firsttry.app/cheatsheets/access-control-models · original reference written from published exam objectives. Not affiliated with any certification body.
The models
| Model | Who decides | Typical use |
|---|---|---|
| DAC | The data owner | File shares, most operating systems |
| MAC | The system, from labels | Military and classified environments |
| RBAC | Assignment to a role | Enterprise directories, most business apps |
| ABAC | Policy over attributes | Cloud, context-aware access |
| Rule-based | Static rules on the resource | Firewall and ACL entries |
| Least privilege | Not a model, a principle | Applies inside every model above |
Authentication factors
| Factor | Meaning | Examples |
|---|---|---|
| Something you know | Knowledge | Password, PIN, security question |
| Something you have | Possession | Token, smart card, phone with an authenticator |
| Something you are | Inherence | Fingerprint, face, iris, voice |
| Somewhere you are | Location | GPS, IP geolocation, network segment |
| Something you do | Behavior | Typing rhythm, gait, signature dynamics |
Multifactor: what counts
| Combination | Is it MFA | Why |
|---|---|---|
| Password plus PIN | No | Both are knowledge |
| Password plus TOTP app | Yes | Knowledge plus possession |
| Password plus SMS code | Yes, weakly | Possession, but SIM swapping applies |
| Smart card plus PIN | Yes | Possession plus knowledge |
| Fingerprint plus face | No | Both are inherence |
| Password plus security question | No | Both are knowledge |
AAA and biometric measures
| Term | What it means |
|---|---|
| Authentication | Proving who you are |
| Authorization | What you may do once proven |
| Accounting | Recording what you did |
| RADIUS | AAA protocol, UDP, encrypts the password only |
| TACACS+ | AAA protocol, TCP, encrypts the whole payload, separates the three A's |
| Kerberos | Ticket-based authentication, port 88, time sensitive |
| False acceptance rate (FAR) | Wrong person accepted. The security risk |
| False rejection rate (FRR) | Right person rejected. The usability cost |
| Crossover error rate (CER) | Where FAR and FRR meet. Lower is a better system |
Exams covered
Try it here
Three verified practice questions on this material. Answer one, and see the official page behind the answer.
4-1Security Operations
What is the minimum amount of entropy a session identifier should contain to resist brute-force guessing attacks?
Security Assessment and Testing
How many phases does the Penetration Testing Execution Standard define?
Plan and automate identity governance
Who should be engaged to confirm that people still need access to a resource?
Five free questions on every practice exam. No account, no card.