Access control models (MAC, DAC, ABAC) in Cybersecurity - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is Mandatory Access Control (MAC)?

MAC is a strict access control model where the system enforces access rules based on fixed policies set by an authority. Users cannot change permissions. Access is granted based on security labels.

beginner

Define Discretionary Access Control (DAC).

DAC allows the owner of a resource to decide who can access it. Users have control over permissions and can grant or revoke access to others.

intermediate

What does Attribute-Based Access Control (ABAC) use to decide access?

ABAC uses attributes like user role, resource type, time of access, and environmental conditions to make flexible access decisions.

beginner

Which access control model is the most rigid and controlled by the system?

Mandatory Access Control (MAC) is the most rigid because the system strictly enforces access policies without user control.

beginner

Give a real-life example of Discretionary Access Control (DAC).

Sharing a photo album on social media where you decide who can see or edit the photos is like DAC, because you control access.

Which access control model uses fixed policies set by an authority and does not allow users to change permissions?

A Mandatory Access Control (MAC)

B Discretionary Access Control (DAC)

C Attribute-Based Access Control (ABAC)

D Role-Based Access Control (RBAC)

MAC enforces strict policies set by the system or authority, and users cannot alter permissions.

In which model does the resource owner decide who can access their resources?

A Mandatory Access Control (MAC)

B Attribute-Based Access Control (ABAC)

C None of the above

D Discretionary Access Control (DAC)

DAC lets owners control access permissions to their resources.

Which access control model uses user attributes like role, location, and time to decide access?

A Attribute-Based Access Control (ABAC)

B Mandatory Access Control (MAC)

C Discretionary Access Control (DAC)

D None of the above

ABAC uses multiple attributes to make flexible access decisions.

Which model is best described as the most flexible and context-aware?

A MAC

B DAC

C ABAC

D None

ABAC is flexible because it considers many attributes and conditions.

If a company wants to enforce strict security policies that users cannot override, which model should they use?

A DAC

B MAC

C ABAC

D RBAC

MAC enforces strict policies controlled by the system, preventing user changes.

Explain the main differences between Mandatory Access Control (MAC), Discretionary Access Control (DAC), and Attribute-Based Access Control (ABAC).

Think about who controls access and how decisions are made.

Describe a real-life situation where each access control model (MAC, DAC, ABAC) might be used.

Consider strict control, owner control, and flexible attribute-based control.