GSEC Access Control and Password Management Practice Question
A security team is implementing a new access control system for a research lab. They need to ensure that access decisions are based on the user's role and the sensitivity of the resource, and that users are only granted the minimum permissions necessary to perform their job. Which two access control principles should they apply? (Choose two.)
⚠ Common exam trap
The trap here is selecting MAC or DAC because they sound strict or familiar, but they do not directly address role-based decisions and least privilege as required.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Principle of Least Privilege
Role-Based Access Control (RBAC) bases access decisions on the user's role, and the principle of least privilege ensures users only have the minimum permissions needed. Together, they meet the requirement to use role and resource sensitivity while enforcing least privilege. DAC, MAC, and rule-based access control do not specifically combine role-based decisions with least privilege in the same way.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Discretionary Access Control (DAC)
Why it's wrong here
DAC allows resource owners to set permissions at their discretion, which can lead to inconsistent access and over-privilege. It does not inherently enforce least privilege or role-based decisions. In a research lab with sensitive resources, DAC would rely on individual owners to manage access, which is not scalable and does not ensure minimum necessary permissions based on role or resource sensitivity.
- ✗
Rule-Based Access Control
Why it's wrong here
Rule-based access control uses a set of rules, often based on attributes like time of day or location, to make access decisions. It does not inherently consider user roles or enforce least privilege. While rules can be part of a broader system, they do not directly satisfy the requirements of role-based decisions and minimum necessary permissions as clearly as RBAC and least privilege.
- ✓
Principle of Least Privilege
Why this is correct
The principle of least privilege states that users should be granted only the minimum access rights required to perform their job functions. This directly matches the requirement to grant minimum permissions necessary. Applying this principle reduces the attack surface and limits potential damage from compromised accounts, making it a core component of the desired access control system.
- ✗
Mandatory Access Control (MAC)
Why it's wrong here
MAC uses security labels and clearances to enforce access, often in military or highly classified environments. While it is strict, it is not specifically based on user roles and may be overly complex for a research lab. The scenario asks for role-based decisions and least privilege, which are better addressed by RBAC and least privilege rather than MAC's label-based approach.
- ✓
Role-Based Access Control (RBAC)
Why this is correct
RBAC assigns permissions based on the user's role within the organization, rather than individual discretion. This aligns with the requirement to base access decisions on the user's role. By defining roles and mapping them to necessary permissions, RBAC simplifies administration and ensures users have access only to what their role requires, supporting the principle of least privilege.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
About these practice questions
Courseiva writes every GSEC question from scratch — 351 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GSEC practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GSEC exam.