Security Operations · Topic 11 of 14
Access Control Models, MFA and Passwords
Security+ access control: MFA tokens and codes, rule, role, time, mandatory and discretionary models, just-in-time access, reviews and passkeys.
- 5 min
- MFA needs factors from different categories. Two passwords are one factor.
- Hard tokens are physical, soft tokens are apps, and backup codes are one-time recovery codes.
- Rule-based uses fixed conditions, role-based uses job roles, and time-based uses hours.
What it is
Authentication proves who the user is. Access control decides what an authenticated user may do. Both must be strong, and both need regular review.
This page covers multifactor authentication (MFA), the access control models, access management policies, access reviews and password concepts, including passkeys and passwordless sign in.
How it works
Multifactor authentication
MFA combines factors from at least two different categories: something you know, something you have and something you are. Two passwords are not MFA, because both are something you know.
| Method | What it is |
|---|---|
| Hard token | A physical device, such as a security key or key fob, that proves possession |
| Soft token | An authenticator app on a phone or computer that generates codes or approves sign ins |
| Biometrics | Fingerprint, face or iris, measured by a reader |
| One-time password (OTP) | A code valid for one use, often time-based and changing every 30 seconds, or sent by message |
| Backup code | A one-time recovery code issued in advance, used when the normal factor is lost |
Hardware security keys resist phishing better than codes, because they check the website they are talking to. Codes sent by text message can be intercepted or redirected through subscriber identity module (SIM) swap attacks. Biometrics cannot be changed if stolen, so they are usually paired with another factor.
Backup codes should be stored offline and each one works only once.
Access control models
| Model | How access is decided |
|---|---|
| Rule-based | Fixed rules set by an administrator, such as firewall rules or source address conditions |
| Role-based (RBAC) | Access follows the user's job role |
| Time-based | Access allowed only in set hours or days |
| Mandatory (MAC) | The system enforces labels, such as clearance and classification, and users cannot change them |
| Discretionary (DAC) | The owner of a resource decides who gets access |
| Just-in-time (JIT) | Elevated rights are granted only when needed, for a limited time, then removed |
MAC is strict and used in high security settings. DAC is flexible but easy to misuse, because owners can share widely. RBAC is the usual enterprise choice, because access is managed by role instead of by person.
Just-in-time access removes standing administrator rights. An admin requests elevation, it is approved and logged, and it expires on its own.
Access management
Access management joins authentication with policy. Policies come in two kinds.
| Policy type | Meaning | Example |
|---|---|---|
| Logical or technical | Enforced by systems | Account lockout after failed attempts, conditional access requiring MFA |
| Administrative or business | Written rules people must follow | Approval needed before access is granted, acceptable use rules |
A business policy states the rule, and a technical policy enforces it where possible.
Access review
An access review is a periodic check, usually by managers or data owners, that each user still needs each permission. It removes privilege creep, catches accounts of people who have left and confirms that privileged access is justified. Reviews should be recorded, since auditors often ask for proof.
Password concepts
| Concept | Meaning |
|---|---|
| Passkey | A credential based on a public and private key pair, where the private key stays on the user's device and the site keeps only the public key |
| Password manager | Software that creates and stores a unique, strong password for each site |
| Passwordless | Sign in without a password, using passkeys, security keys or device biometrics |
Passkeys resist phishing because the key works only for the site it was created for, and there is no shared secret on the server to steal.
Password best practices
| Practice | Meaning |
|---|---|
| Length | Longer passwords and passphrases are much harder to guess |
| Complexity | Mixing character types, though length matters more |
| Reuse | Block reuse of old passwords and of the same password across sites |
| Expiration | The maximum age before a change is forced |
| Age | The minimum age stops users cycling back to an old password at once |
| Compromised credential monitoring | Checking passwords and accounts against known breach data |
| Account auditing | Reviewing accounts for weak settings, inactivity and misuse |
| Policy report | A report showing how well accounts meet the password policy |
Current National Institute of Standards and Technology (NIST) guidance favors length and screening against breached passwords over forced periodic changes, which it advises only when there is evidence of compromise.
How the exam asks about this
- "Staff need a factor that resists phishing sites." -> A hard token such as a security key, or a passkey.
- "Contractors may sign in only during business hours." -> Time-based access control.
- "Admin rights should exist only while a task is being done." -> Just-in-time access.
What to remember for the exam
- MFA needs factors from different categories. Two passwords are one factor.
- Hard tokens are physical, soft tokens are apps, and backup codes are one-time recovery codes.
- Rule-based uses fixed conditions, role-based uses job roles, and time-based uses hours.
- MAC uses system-enforced labels. DAC lets owners decide.
- Just-in-time grants temporary elevation and removes standing admin rights.
- Policies are logical or technical, and administrative or business.
- Access reviews confirm that permissions are still needed.
- Passkeys and password managers support strong, unique, phishing-resistant sign in.
If a question describes labels like "secret" and "top secret" set by the system, it is mandatory access control.
Common mistakes
Treating two passwords as MFA. Both are the same factor, so it is still single factor.
Confusing role-based with rule-based. One uses job roles, the other uses fixed conditions.
Trusting text message codes as the strongest option. They can be intercepted or redirected.
Keeping standing admin rights. Always-on privileged access gives attackers a bigger prize.
Forcing frequent password changes as the main defense. Length and breach screening do more.
Shared administrator accounts break accountability. Use named accounts so every action is tied to a person.
Check yourself
Which access control model lets the resource owner decide who gets access?
Discretionary access control (DAC).
Why is a password plus a PIN not multifactor authentication?
Both are something you know, so they are the same factor category.
What is a backup code used for?
A one-time recovery code that lets a user sign in when the normal MFA factor is lost.
Topic 11 of 14 in Security Operations
Test yourself on Security Operations
The full CompTIA Security+ SY0-801 question bank has 998 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.