SY0-701 General Security Concepts Practice Question
Exhibit
File access requirement Rules: - Users may open documents only if Department matches the file owner department - Contractors may access only files tagged Project=Orion and Clearance=Internal - Managers may access files for employees in their own business unit - Access decisions must consider user attributes and file tags at request time
Based on the exhibit, which access model best fits the business requirement without creating many custom roles?
⚠ Common exam trap
It's easy for candidates to default to RBAC as the simplest model, but the question explicitly requires avoiding many custom roles, which RBAC would necessitate if the business needs are complex or dynamic, whereas ABAC provides attribute-based flexibility without role explosion.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ABAC, because access can be evaluated using user, resource, and environment attributes together.
B is correct because Attribute-Based Access Control (ABAC) evaluates multiple attributes (user, resource, environment) to dynamically determine access, which fits a business requirement that needs flexible, context-aware permissions without creating many custom roles. Unlike RBAC, ABAC avoids role explosion by using policies that combine attributes, making it ideal for environments where access decisions depend on factors like time, location, or data sensitivity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
RBAC, because every user can be placed into a fixed role that never changes.
Why it's wrong here
RBAC would force administrators to predefine roles from static job functions, but the exhibit's access logic depends on dynamic attributes such as department, security clearance, project tags, and business unit. Since these attributes can change per request or per user, a fixed role set would either become too coarse—granting access after a transfer—or explode into hundreds of narrowly defined roles to approximate the same rules. The 'never changes' framing is also inaccurate operationally, because role assignments must be constantly updated to mirror attribute changes, making RBAC brittle here.
- ✓
ABAC, because access can be evaluated using user, resource, and environment attributes together.
Why this is correct
The exhibit requires decisions based on attributes such as department, clearance, project tags, and business unit. ABAC is built for that kind of dynamic rule set and avoids creating a separate role for every possible combination.
- ✗
DAC, because each file owner can decide access individually without any central rule engine.
Why it's wrong here
DAC delegates authorization decisions to each resource owner, who manually sets permissions on files or objects, so there is no centralized policy engine to evaluate user, resource, and environment attributes consistently. In this scenario, a file owner would have to know and re-enter clearance levels, department memberships, and project tags for every possible requester, leading to inconsistent, duplicated, and often overly permissive access. The exhibit's rule-based model requires a single authoritative evaluator that can combine attributes at request time, not subjective owner-by-owner choices.
- ✗
MAC, because users should manually grant access to themselves when needed.
Why it's wrong here
MAC is centrally enforced by trusted system software using fixed security labels (e.g., classification levels) imposed on subjects and objects, and users are expressly prohibited from granting access to themselves or changing labels. The exhibit's access decision is dynamic and attribute-rich—combining user attributes, file tags, and environmental context at request time—rather than a static label comparison. Describing MAC as 'users should manually grant access to themselves' misstates the model: MAC's defining rule is that even owners cannot override the mandatory policy.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Access Control Models (DAC, MAC, RBAC)
Key term
ABAC
ABAC (Attribute-Based Access Control) is a method of controlling access to resources by evaluating a set of attributes (such as user role, time, location, and device) against policy rules, rather than using static roles or identities.
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.