Fastest way to remember the four models
Use the main decision driver. If access follows a job role, think RBAC. If access is evaluated through attributes and policy rules, think ABAC. If the file or resource owner decides, think DAC. If access is controlled by labels, classification, and clearance, think MAC.
RBAC vs ABAC vs DAC vs MAC
| Model | Main idea | Access based on | Who grants or controls access? | Typical exam clue |
|---|---|---|---|---|
| RBAC | Role-based access | Job role or function | Admins assign roles and the permissions attached to them | Role, title, department function |
| ABAC | Attribute- and rule-based access | User, resource, action, and environment attributes | Policy engine or rules evaluate access | If/then policies using department, time, device, location, etc. |
| DAC | Owner-controlled access | Owner discretion | Resource owner | Owner chooses who can access the file or resource |
| MAC | Mandatory, label-based access | Classification and clearance | Central authority or system policy | Secret, Top Secret, clearance, labels, need-to-know |
1. RBAC: role-based access control
RBAC assigns permissions to roles rather than directly to every individual user. Users are placed into roles such as HR manager, nurse, or system administrator, and they inherit the permissions associated with those roles.
Best fit
RBAC works well when access requirements are stable and map cleanly to job responsibilities.
2. ABAC: attribute-based access control
ABAC evaluates multiple attributes and policy rules to decide whether access should be allowed. These attributes can include department, device type, time of day, location, action requested, resource sensitivity, and more.
Best fit
ABAC is ideal for fine-grained, flexible, and context-aware authorization decisions.
3. DAC: discretionary access control
In DAC, the owner of a resource decides who gets access. The owner can grant, revoke, or share access at their discretion. This makes DAC flexible, but typically less strict than centrally enforced approaches.
Best fit
DAC commonly appears when users manage permissions on their own files or folders.
4. MAC: mandatory access control
MAC uses centrally enforced labels, classifications, and clearance levels. Users cannot freely override permissions. The system enforces strict rules such as Secret, Top Secret, clearance requirements, and need-to-know constraints.
Best fit
MAC is commonly associated with military, government, or other highly classified environments.
Common CompTIA Security+ exam traps
- RBAC is role-based, not owner-based.
- ABAC is not just roles with a new name. It uses attributes and rules.
- DAC means the owner decides. If a file owner can share or revoke access, think DAC.
- MAC is the strict, centrally enforced model. Look for labels, classification, and clearance.
- If you see need-to-know or Top Secret, think MAC.
Mini Security+ scenarios
A hospital gives all users in the Nurse role the same access to patient chart systems.
A system allows access only if the employee is in HR, is using a managed device, and is connecting before 6 PM from HQ.
An employee shares a document they own with a teammate and later revokes that access.
A report labeled Top Secret can be opened only by users with Top Secret clearance and a need-to-know.
A simple decision method for exam questions
When you see an access control scenario, ask these questions in order:
- Is access based on a role or job title? → RBAC
- Is access based on attributes and rules? → ABAC
- Can the owner decide who gets access? → DAC
- Are labels, clearance, or classification involved? → MAC
This shortcut works well on Security+ because the exam often gives one obvious clue that points directly to the correct model.
Frequently asked questions
What is the difference between RBAC and ABAC?
RBAC grants access based on roles such as manager or nurse. ABAC makes decisions using attributes and policy rules such as department, time, location, device, and action.
What is the main clue for DAC?
The strongest clue is that the resource owner can choose who gets access or can share and revoke permissions.
What is the main clue for MAC?
MAC usually involves labels, classification levels, clearance, and strict centrally enforced rules.
Which access control model is most associated with military or government systems?
MAC is most strongly associated with classified or highly controlled environments such as military or government systems.