thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Commonly confused · Security Fundamentals & Crypto

DAC vs MAC vs RBAC: Access Control Models Compared

In DAC the resource owner decides who gets access, in MAC the system enforces access by comparing security labels with clearances, and in RBAC permissions are assigned to job roles and users inherit them through role membership.

Discretionary Access Control (DAC)

Full definition
vs

Mandatory Access Control (MAC)

Full definition
vs

Role-Based Access Control (RBAC)

Full definition
Discretionary Access ControlMandatory Access ControlRole-Based Access Control
Who decides accessData ownerSystem/administrator via labelsAdministrator via role definitions
BasisOwner discretion, ACLsClassification labels and clearancesJob function
FlexibilityHighLow, very rigidModerate
Security strengthWeakest, prone to over-sharingStrongestStrong and manageable
Typical environmentWindows NTFS, Linux file permissionsMilitary, government, SELinuxEnterprises, HR-driven provisioning
Key termOwnerLabels (Secret, Top Secret)Roles and groups
Remember it

DAC: owner decides. MAC: labels decide. RBAC: job decides.

Exam tip

Scenarios mentioning clearances, classifications, or labels mean MAC. A file creator granting access to coworkers means DAC. New hires getting permissions by job title means RBAC.

Tested on

More Security Fundamentals & Crypto look-alikes