Access Control Concepts

Accountability, Auditing and the AAA Model

Access control is not finished at the point of granting access. The third A - accounting - is what makes misuse detectable, and it depends entirely on identity being unique.

Exam tip. Any scenario about proving who performed an action reduces to unique identity plus protected logs.

Provisioning, Review and Deprovisioning

Accounts must be managed across their whole life, not just created. Most access-related audit findings come from the middle and end of this lifecycle rather than the beginning.

Exam tip. Access reviews are the detective control that catches whatever the joiners-movers-leavers process missed.

DAC, MAC, RBAC and ABAC

Four models, distinguished by who makes the access decision and on what basis. Scenario questions describe the decision mechanism and expect you to name the model.

Exam tip. Classification labels that users cannot override means MAC. Job function means RBAC.

Physical Access Controls and Accountability

Physical access defeats most logical controls, so this is a first-class security concern rather than a facilities matter. Distinguish controls that prevent from those that merely record.

Exam tip. Shared codes and keys break accountability because entries cannot be tied to an individual.

Physical Security Layers and Environmental Controls

Physical protection is layered from the perimeter inward, and environmental conditions are an availability control in their own right.

Exam tip. Environmental failures cause as much downtime as attackers. Heat, water and power are security concerns.

Password Policy and Credential Hygiene

Passwords remain the most attacked credential. CC follows modern guidance, which favours length and screening over frequent forced rotation.

Exam tip. Frequent forced expiry is no longer best practice. Watch for it offered as a distractor.

Authorisation Mechanisms and Provisioning at Scale

Granting access consistently across many systems is an operational problem as much as a security one. These are the mechanisms CC expects you to name.

Exam tip. Break-glass accounts are legitimate but must be monitored. An unmonitored emergency account is a backdoor.

1. A firewall permits or denies traffic according to a fixed list of conditions applied to every request equally. Which model does this best illustrate?

• A. Mandatory access control
• B. Rule-based access controlcorrect
• C. Discretionary access control
• D. Role-based access control

Rule-based access control applies the same set of predefined rules to all subjects, without regard to identity or role. Firewall rule sets are the standard example. It differs from role-based control because nothing about who the user is changes the outcome.

2. Users are granted permissions based on the job function they hold rather than individually. Which access control model is this?

• A. Role-based access controlcorrect
• B. Discretionary access control
• C. Mandatory access control
• D. Attribute-based access control

RBAC assigns permissions to roles and users to roles, which simplifies administration as people join, move and leave. DAC lets owners decide, MAC uses system-enforced labels, and ABAC evaluates multiple attributes per request.