SY0-701 Security Architecture Practice Question
An HR department wants each employee to access only the systems required for their job. A new hire should receive the same permissions as other HR specialists, and changes to the role should update access centrally. Which access model should be used?
⚠ Common exam trap
A common mix-up: candidates confuse ABAC with RBAC because both can use attributes, but RBAC relies on static role assignments, whereas ABAC evaluates dynamic attributes at runtime, making RBAC the correct choice for role-based inheritance and centralized updates.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Role-based access control (RBAC)
Role-based access control (RBAC) is the correct model because it assigns permissions based on job roles (e.g., HR specialist), ensuring that a new hire automatically inherits the same access as others in that role. Centralized role management allows changes to the role's permissions to propagate to all members, meeting the requirement for centralized updates.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Role-based access control (RBAC)
Why this is correct
Role-based access control (RBAC) maps permissions to job roles rather than to individuals; HR can define a role like 'HR Specialist' with access solely to the HRIS, payroll, and recruitment systems, then assign employees into that role. This centralizes onboarding, role changes, and terminations because access changes to a role propagate to all members, which directly satisfies the need for each employee to access only the systems their job requires. RBAC enforces least privilege at the role level, making it the correct access control model for this scenario.
- ✗
Attribute-based access control (ABAC)
Why it's wrong here
Attribute-based access control (ABAC) makes access decisions by evaluating policies against a rich set of attributes—for example user department, resource sensitivity, time of day, location, or device compliance—which allows extremely fine-grained and dynamic rules. However, that granularity comes with policy complexity and is not the primary model when the requirement is simply to assign standard users to systems based on their job role. In ABAC, the same employee could be denied or granted access based on environmental conditions, whereas the scenario demands a clear, role-driven mapping.
- ✗
Multi-factor authentication (MFA)
Why it's wrong here
Multi-factor authentication (MFA) is an authentication control that requires the user to present two or more verification factors (e.g., password, TOTP, biometric) before a session is established; it verifies the user's identity but says nothing about what applications or data that authenticated identity may use. HR's goal is to define which systems each employee can access, which is a purely authorization task, not an identity verification one. MFA can be layered on top of RBAC for stronger security, but it can never replace it because it does not assign permissions to roles or users.
- ✗
Privileged access management (PAM)
Why it's wrong here
Privileged access management (PAM) focuses on securing, minting, and monitoring elevated accounts—like local admins, domain admins, or root—using credential vaults, session recording, and just-in-time elevation. It does not act as the primary authorization model for assigning standard employees to their routine business systems. Even if PAM is deployed, HR would still need a role model to grant each employee the appropriate baseline access to their department's applications.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Unified Threat Management (UTM)
Key term
RBAC
RBAC is a method of restricting network access based on the roles of individual users within an organization, where permissions are assigned to roles rather than to individuals directly.
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.