Role-Based Access Control (RBAC) for Security+
An organization is redesigning access for a finance application. Employees should be able to approve expense reports only within their assigned job roles, and every approval must be traceable to the individual user who performed it. Which access model best fits this requirement?
Quick Answer
The answer is role-based access control (RBAC), because it assigns permissions strictly by job function and ties every action to a named user account. This model directly meets the requirement for traceable approvals within assigned roles, as RBAC maps roles like “Finance Approver” to specific permissions, while user authentication ensures each approval is logged against an individual. On the Security+ SY0-701 exam, this scenario tests your understanding of how RBAC differs from discretionary (DAC) or mandatory (MAC) models—common traps include confusing RBAC with attribute-based control (ABAC) or assuming DAC’s owner-set permissions suffice. Remember that RBAC’s core principle is “permissions follow the role, not the user,” which guarantees both segregation of duties and non-repudiation. For a quick memory tip: think “Role first, user second” to distinguish RBAC from other access control models.
⚠ Common exam trap
Many candidates confuse 'rule-based access control' (which uses condition-based rules like time-of-day) with 'role-based access control' (which uses job functions), leading them to select option D despite the question's clear focus on job roles and user traceability.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Role-based access control, because permissions are assigned by job function and tied to named users.
Role-based access control (RBAC) is the correct choice because it assigns permissions based on job functions (e.g., 'Finance Approver') and links those permissions to named user accounts. This ensures that only employees in the appropriate role can approve expense reports, and each approval action is logged against the specific user, providing non-repudiation and traceability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Mandatory access control, because a central authority labels each expense report by sensitivity.
Why it's wrong here
MAC is driven by centrally assigned labels, but the scenario is about business roles and auditability, not classification labels.
- ✓
Role-based access control, because permissions are assigned by job function and tied to named users.
Why this is correct
RBAC matches a finance workflow where users inherit permissions based on job roles such as approver, reviewer, or auditor. It is easy to administer, supports least privilege, and works well when access should be consistent for groups with similar duties. The requirement to trace approvals to individuals is also satisfied when each person uses a unique account and actions are logged.
- ✗
Discretionary access control, because individual employees decide who can approve expenses.
Why it's wrong here
DAC lets resource owners share permissions at their discretion, which is less controlled than the role-driven model described.
- ✗
Rule-based access control, because approval rights are determined only by the time of day.
Why it's wrong here
Rule-based access can enforce conditions, but the question focuses on job-based assignment rather than conditional timing rules.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Access Control Models (DAC, MAC, RBAC)
Key term
RBAC
RBAC is a method of restricting network access based on the roles of individual users within an organization, where permissions are assigned to roles rather than to individuals directly.
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Based on the exhibit, which access model best fits the business requirement without creating many custom roles?
medium- A.RBAC, because every user can be placed into a fixed role that never changes.
- ✓ B.ABAC, because access can be evaluated using user, resource, and environment attributes together.
- C.DAC, because each file owner can decide access individually without any central rule engine.
- D.MAC, because users should manually grant access to themselves when needed.
Why B: B is correct because Attribute-Based Access Control (ABAC) evaluates multiple attributes (user, resource, environment) to dynamically determine access, which fits a business requirement that needs flexible, context-aware permissions without creating many custom roles. Unlike RBAC, ABAC avoids role explosion by using policies that combine attributes, making it ideal for environments where access decisions depend on factors like time, location, or data sensitivity.
Variation 2. Based on the exhibit, which access change best follows least privilege while still allowing the help desk to complete the task?
hard- A.Add helpdesk_27 to Domain_Admin for seven days, since the request is urgent and time-limited.
- B.Use a shared administrator password so the technician can finish the ticket without changing group memberships.
- ✓ C.Grant helpdesk_27 the Helpdesk_Admin role for the ticket and remove it after completion.
- D.Ask the user's manager to perform the reset manually so the help desk does not need additional access.
Why C: It implements Role-Based Access Control (RBAC) by granting the help desk technician a temporary, ticket-specific role (Helpdesk_Admin) that provides just enough privileges to perform the password reset without granting broader administrative rights. This follows the principle of least privilege by limiting the elevated access to the exact scope and duration needed, and the role can be automatically revoked after the ticket is closed, minimizing the attack surface.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.