# Authentication and Access Control

> Chapter 13 of the Courseiva ITF-PLUS curriculum — https://courseiva.com/learn/itf-plus/authentication-and-access-control

**Official objective:** 5.2 — Explain authentication methods and access control concepts.

## Introduction

Exam domain 5.2, “Explain authentication methods and access control concepts,” is one of the most tested areas on the FC0-U71 exam. Without understanding how systems verify who you are and what you are allowed to do, you cannot grasp basic IT security – and you will miss several exam questions that are otherwise straightforward.

## The Office Building Key Card Analogy

A standard office building key card is a small plastic rectangle that grants entry to specific areas.  

When you arrive at work, you present your card to a reader at the front door. The reader checks two things: who you are (your identity) and whether you should be allowed in right now (your permissions). This is authentication – proving you are who you claim to be. The card itself contains a unique number tied to your employee record. If the number matches an active account in the security system, the door unlocks. If it does not match – for example, if the card is expired or has been reported lost – the door stays locked.  

Once inside, you might go to the finance department. Your key card opens the finance door only if your job role requires access to financial records. If you are in marketing, the finance door remains locked even though your card worked perfectly at the main entrance. This is access control – deciding what you can do after you have been authenticated. The building security system uses a list (an access control list) that says “employee ID 5432 can enter floors 1–3 and the break room, but not the server room or the CEO’s office.”  

If you lose your card and report it, the security desk immediately deactivates that card number. A thief who finds the card later cannot use it because the system no longer recognises that number as valid. This mirrors how IT systems revoke compromised passwords or tokens – the access is cut off at the server, not at the card itself.

## Core explanation

Authentication and access control are two separate but closely related concepts that together form the foundation of computer security.  

Authentication is the process of verifying that a user, device, or system is who or what it claims to be. It answers the question “Who are you?” The most common form is a username and password. When you log into a website, you type your username (your claimed identity) and your password (your secret proof). The server checks the password against a stored version – usually a hashed (scrambled) version – and if they match, you are authenticated.  

There are three main categories of authentication factors, often called the “three factors of authentication”:  

- Something you know: a password, a PIN, the answer to a security question.  
- Something you have: a physical token like a smart card, a hardware security key, or a one-time code sent to your mobile phone.  
- Something you are: a biometric like a fingerprint, facial recognition, or iris scan.  

Using two or more of these factors together is called multi-factor authentication (MFA). For example, logging into a bank account with a password (something you know) and then entering a code from an authenticator app (something you have) uses two factors. MFA is far more secure than a password alone because an attacker would need to compromise multiple separate things.  

Access control is what happens after authentication is successful. It determines what the authenticated user is allowed to do – which files they can read, which programs they can run, which network resources they can reach. It answers the question “What are you allowed to do?”  

There are three main models of access control tested on the FC0-U71 exam:  

- Discretionary Access Control (DAC): The owner of a resource decides who can access it. For example, in a file system, you can set permissions on your own documents to allow or deny specific users. This is common in personal computers.  
- Mandatory Access Control (MAC): The operating system or a central authority enforces access rules that users cannot override. Every resource has a security label (like “top secret” or “unclassified”), and every user has a clearance level. A user with “secret” clearance cannot read a “top secret” document, even if they own it. This is used in military and government systems.  
- Role-Based Access Control (RBAC): Access is determined by a user’s role within an organisation, not by their individual identity. For example, all “accountants” can read financial records; all “nurses” can view patient records. When an employee changes role, their access automatically changes. RBAC is widely used in corporate networks and cloud services.  

The system that enforces these rules is often called an Access Control List (ACL). An ACL is a table that lists each user or group and their permissions for a particular resource. For example, a file’s ACL might say “user Alice: read and write; group Marketing: read only; everyone else: no access.”  

Why does authentication happen before access control? Because the system must first know who you are before it can check what you are allowed to do. If you try to access a file without logging in first, the system will refuse because it has no identity to check against the ACL.  

In modern IT environments, these concepts extend to cloud services and APIs. When you use a cloud application like Google Drive, your browser authenticates you with Google’s servers (often using OAuth, a token-based authentication protocol), and then the cloud service checks your permissions (which files you can see) based on your account role.  

Access control also includes concepts like least privilege – the principle that users should be given only the minimum access needed to do their job. If a user only needs to read reports, do not give them write access. This reduces the damage from accidents or malicious actions.  

Another important idea is separation of duties – splitting critical tasks across multiple people so no single person has too much power. For example, the person who approves a purchase order should not be the same person who writes the cheque. In IT, an administrator might create user accounts, but a separate manager should approve privilege changes.  

Authentication methods also include single sign-on (SSO), where one login gives you access to multiple systems. For example, logging into your company’s portal with Microsoft Entra ID (formerly Azure Active Directory) authenticates you once, and then you can access email, file shares, and project management tools without re-entering credentials. SSO relies on a central identity provider that other services trust.  

Finally, authentication and access control systems must generate logs – records of who authenticated, when, and what they accessed. These logs are crucial for security audits and incident investigations. If a breach occurs, the logs can show exactly which user account was used and what resources were accessed.

## Real-world context

A small IT company called GreenLeaf Consulting has 50 employees. The IT manager, Priya, must set up authentication and access control for the company’s cloud systems.  

Priya first deploys Microsoft Entra ID as the identity provider. Every employee gets a unique username and a strong password. She enforces multi-factor authentication (MFA) for everyone: users must enter a code from an authenticator app on their phone after typing their password. This prevents a stolen password alone from granting access.  

Next, Priya sets up Role-Based Access Control (RBAC). She creates three roles:  

- “Staff”: can read their own email and access the company calendar.  
- “Manager”: can read all staff email (for compliance purposes) and approve time-off requests.  
- “Administrator”: can configure cloud services, create new user accounts, and view all logs.  

She assigns each employee to exactly one role. A new hire, James, joins as an accountant. Priya assigns him the “Staff” role. James can access his email and calendar but cannot modify the accounting database. When James is later promoted to accounting manager, Priya changes his role to “Manager”, and he automatically gains the ability to view all financial emails and approve invoices. He never gets administrator access because he does not need it – this follows the principle of least privilege.  

One day, Priya receives an alert that an account has been locked after 10 failed login attempts. She checks the logs and sees the attempts came from an IP address in another country. She immediately resets the password for that user and enforces a new MFA registration. The logs show exactly which IP address tried to authenticate, at what time, and with which username.  

Priya also configures an Access Control List (ACL) on a shared folder containing client contracts. The ACL says:  

- The legal team gets read and write access (they create and edit contracts).  
- The sales team gets read-only access (they view contracts for reference).  
- All other employees have no access (they cannot even see the folder exists).  

When a salesperson tries to open a contract, the file system checks their identity, confirms they are authenticated, and then checks the ACL. Because the salesperson is in the sales group (which has read-only permission), the file opens. If a marketing employee tries, the ACL denies access, and the system returns an “access denied” error.  

Finally, Priya sets up single sign-on (SSO) so employees log into Microsoft Entra ID once and can then access their email (Exchange Online), file storage (SharePoint Online), and project management tool (Trello) without re-entering passwords. This reduces password fatigue and the risk of weak passwords.  

Priya’s system protects GreenLeaf from common attacks. If an attacker steals a password but does not have the employee’s phone, MFA blocks them. If an employee leaves the company, Priya disables their account, instantly revoking all access across every system. The access control model ensures that no employee can accidentally or maliciously access data outside their job role.

## Exam focus

The FC0-U71 exam objective 5.2 tests your knowledge of authentication and access control concepts directly. Expect 4–6 questions on this domain.  

The exam loves to test the difference between authentication and authorisation. Many questions present a scenario and ask which one is happening. The correct answer pattern: if the scenario involves proving identity (password, fingerprint, token), it is authentication. If it involves granting or denying access to a resource after identity is known, it is authorisation (access control).  

Key concepts you must memorise:  

- The three factors of authentication: something you know, something you have, something you are.  
- Multi-factor authentication (MFA) requires two or more different factors – using two passwords is NOT MFA, because they both fall under “something you know”.  
- Role-Based Access Control (RBAC) versus Discretionary Access Control (DAC) versus Mandatory Access Control (MAC). The exam often gives a description and asks you to identify the model.  
- The principle of least privilege and separation of duties – know the definitions and why they are important.  
- Access Control Lists (ACLs) – what they contain (user/group and permissions) and where they are used (files, network devices).  
- Single Sign-On (SSO) – reduces password reuse and centralises authentication.  
- Biometrics – examples like fingerprint, retina scan, facial recognition, and voice recognition. Be aware that biometrics are “something you are” and are not foolproof (false positives/negatives exist).  
- Common authentication protocols: know that Kerberos is a network authentication protocol, and OAuth is used for token-based authorisation (especially in web and mobile apps). The exam may ask about their purpose.  

Common exam traps:  

- A question might describe a user logging in with a password and then a fingerprint. The answer is MFA, but watch out for an option that says “two passwords” – that is a distractor because both are the same factor.  
- A scenario where a file owner sets permissions – that is DAC (Discretionary Access Control). A scenario where the system enforces labels (like “top secret”) – that is MAC.  
- The exam may list “username” and “password” as separate items – they are not separate factors; both are “something you know”.  
- “Something you have” includes smart cards, hardware tokens, and mobile phone authenticator apps (which generate codes), but NOT passwords or PINs.  
- Be ready to identify the difference between authorisation and accounting (logging) – accounting is not tested deeply here, but the exam may ask about logs being part of access control tracking.  
- The term “AAA” (Authentication, Authorisation, Accounting) appears in some questions. Know that AAA is a framework for controlling access to network resources.  

The exam uses straightforward scenario-based questions. For example: “A company wants to ensure that a user must provide both a password and a code from a mobile app. Which concept describes this?” The answer is MFA. Another: “A hospital uses role-based access so nurses see patient records but not billing data. Which principle is being applied?” The answer is least privilege.  

Memorise the three access control models and their keywords: DAC (owner decides), MAC (labels and clearances), RBAC (roles). For authentication factors, memorise “something you know, have, are” and examples of each.

## Step by step

1. **User Requests Access** — A user attempts to open a file, log into a system, or access a network resource. The system receives the request but does not yet know who the user is. This triggers the authentication process.
2. **System Prompts for Credentials** — The system asks the user to provide proof of identity. This could be a username and password (something you know), a fingerprint scan (something you are), or a code from a hardware token (something you have). The system does not grant access yet.
3. **System Verifies Credentials** — The system compares the provided credentials against a stored database. Passwords are usually hashed (scrambled) so the system checks the hash, not the plain text. If the credentials match, the user is authenticated. If not, access is denied, and the system may log the failed attempt.
4. **System Checks Authorisation** — After authentication, the system looks up the user’s permissions for the requested resource. It checks the Access Control List (ACL) or role-based permissions to decide whether the user is allowed to read, write, execute, or delete the resource. This step is authorisation, not authentication.
5. **System Grants or Denies Access** — If the user has the required permissions, the system allows the action (e.g., opens the file). If not, the system returns an “access denied” error. The decision is logged for auditing purposes, recording who accessed what and when.

## Comparisons

### Authentication vs Authorisation (Access Control)

**Authentication:**
- Answers 'Who are you?'
- Happens before access control
- Uses credentials like passwords, biometrics, tokens

**Authorisation (Access Control):**
- Answers 'What are you allowed to do?'
- Happens after authentication
- Uses permissions, ACLs, roles

### Discretionary Access Control (DAC) vs Mandatory Access Control (MAC)

**Discretionary Access Control (DAC):**
- Owner sets permissions on resources
- Common on personal computers
- Users can change permissions on their own files

**Mandatory Access Control (MAC):**
- System enforces labels and clearances
- Common in military/government systems
- Users cannot override system rules

### Role-Based Access Control (RBAC) vs Attribute-Based Access Control (ABAC)

**Role-Based Access Control (RBAC):**
- Access based on job role
- Simpler to manage for many users
- Roles are predefined and static

**Attribute-Based Access Control (ABAC):**
- Access based on user attributes (department, time, location)
- More flexible and fine-grained
- Rules can consider multiple conditions

### Single Sign-On (SSO) vs Separate Logins

**Single Sign-On (SSO):**
- One login grants access to multiple systems
- Reduces password fatigue
- Centralised authentication management

**Separate Logins:**
- Each system requires its own login
- Users may reuse weak passwords across systems
- More logins to manage and secure

## Diagram

_Flowchart showing the process from authentication to access control decision._

```mermaid
flowchart TD
    A[User] -->|Provides Credentials| B[Authentication System]
    B -->|Valid?| C{Match?}
    C -->|No| D[Access Denied]
    C -->|Yes| E[User Authenticated]
    E --> F[Request Resource]
    F --> G[Access Control System]
    G -->|Check ACL or Role| H{Permission?}
    H -->|No| I[Access Denied]
    H -->|Yes| J[Access Granted]
```

## Common misconceptions

- **Misconception:** Authentication and authorisation are the same thing – once you log in, you can do anything. **Reality:** Authentication is verifying identity; authorisation is granting permissions. Logging in does not mean you have access to everything. Even after authentication, the system checks your permissions (authorisation) before allowing actions. (Beginner users often experience systems where a single login gives them full access (like a personal computer), so they assume the same applies everywhere.)
- **Misconception:** Multi-factor authentication means using two passwords or a password and a security question. **Reality:** MFA requires two different factors from the three categories (something you know, something you have, something you are). Two passwords are both the same factor (something you know), so that is not MFA. (The word 'multi' is misinterpreted as 'multiple of the same thing' rather than 'multiple categories'.)
- **Misconception:** Biometrics are completely secure and cannot be bypassed. **Reality:** Biometrics can be spoofed (e.g., a high-quality photo for facial recognition, a lifted fingerprint). They also have false acceptance rate (FAR) and false rejection rate (FRR). They are a strong factor but not infallible. (Movies and marketing often portray biometrics as unbreakable, leading to an overestimate of their security.)
- **Misconception:** Role-Based Access Control means that users in the same role all have exactly the same access, regardless of individual circumstances. **Reality:** RBAC assigns permissions based on role, but roles can be refined with exceptions and hierarchical structures. However, the core idea is that access is tied to the role, not the individual. Exceptions can exist but are not the default. (Beginners think roles are rigid boxes when in reality RBAC systems often allow temporary exceptions or nested roles.)
- **Misconception:** If a user is authenticated and has access to a resource, they can share that resource with anyone. **Reality:** Access control policies often restrict sharing. In DAC, the resource owner can share. In MAC, even the owner cannot share with someone who lacks the correct clearance. RBAC may prevent sharing if the role does not include sharing permissions. (People assume ownership means full control, but in many systems (especially MAC), the system overrides user decisions.)
- **Misconception:** Single sign-on (SSO) means you never need to authenticate again after the first login. **Reality:** SSO reduces the number of logins but does not eliminate them. Sessions expire, and you may be prompted to re-authenticate after a period of inactivity or when accessing sensitive resources. SSO also relies on a central identity provider that can be a single point of failure. (Users expect SSO to be permanent because it feels seamless, but security requires periodic re-verification.)

## Key takeaways

- Authentication verifies who you are; authorisation (access control) verifies what you are allowed to do.
- Multi-factor authentication uses at least two different factors from the categories something you know, something you have, or something you are.
- The three main access control models are Discretionary (owner decides), Mandatory (labels and clearances), and Role-Based (permissions tied to job role).
- Least privilege means giving users only the minimum access necessary to perform their job duties.
- An Access Control List (ACL) is a list attached to a resource that specifies which users or groups have which permissions.
- Single sign-on (SSO) allows one login to access multiple systems, reducing password fatigue and centralising authentication management.
- Biometrics are a strong authentication factor but can be spoofed and have error rates; they are not foolproof.
- Separation of duties splits critical tasks across multiple people to prevent fraud or abuse.
- Logs record authentication and access events and are essential for security audits and incident investigation.
- OAuth is a token-based authorisation protocol commonly used for delegating access in web and mobile applications.

## FAQ

**What is the difference between authentication and authorisation?**

Authentication is proving you are who you say you are (like showing your ID). Authorisation is what you are allowed to do after you have proven your identity (like being allowed into a specific room).

**Is using a password and a fingerprint considered multi-factor authentication?**

Yes, because a password is “something you know” and a fingerprint is “something you are” – they are two different factors.

**What does least privilege mean?**

Least privilege means giving a user only the minimum permissions needed to do their job – no more. For example, if an employee only needs to read files, do not give them write or delete access.

**What is an Access Control List (ACL)?**

An ACL is a list attached to a file, folder, or network resource that specifies which users or groups have which permissions (read, write, execute). The system checks the ACL every time someone tries to access the resource.

**Does single sign-on (SSO) mean I never have to log in again?**

No. SSO reduces how often you log in within a session, but sessions expire. You may need to re-authenticate after inactivity, or when accessing highly sensitive resources.

**Can biometrics be hacked?**

Yes. Biometrics can be spoofed with fake fingerprints, high-resolution photos, or voice recordings. They are a strong factor but not infallible, which is why they are often combined with other factors (MFA).

**What is the difference between DAC, MAC, and RBAC?**

DAC (Discretionary) lets the resource owner decide permissions. MAC (Mandatory) uses system-enforced labels and clearances that users cannot override. RBAC (Role-Based) assigns permissions based on job role.

## Check your understanding

1. **A user logs into a system using a smart card and a PIN. Which authentication factors are being used?**

   Answer: Something you have (the smart card) and something you know (the PIN).

2. **In which access control model does the owner of a resource decide who can access it?**

   Answer: Discretionary Access Control (DAC).

3. **What does the principle of least privilege mean in practice?**

   Answer: A user should be given only the minimum permissions necessary to perform their job duties.

4. **Name one key difference between authentication and authorisation.**

   Answer: Authentication proves identity; authorisation determines what an authenticated user is allowed to do.

5. **What is an Access Control List (ACL) used for?**

   Answer: An ACL specifies which users or groups have permissions (read, write, execute) for a specific resource.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/itf-plus/authentication-and-access-control