Use this domain to understand how access is granted, controlled, monitored, and reviewed. Access control is one of the most important security areas because unauthorized access can lead to data exposure, system compromise, fraud, and operational risk.
Physical access controls protect facilities, rooms, equipment, people, and physical records. Cybersecurity is not only digital. If someone can enter a secure room or access a device physically, they may bypass technical controls.
- Physical security controls prevent unauthorized physical entry.
- Monitoring helps detect unauthorized access.
- Logs and badges create accountability.
- Environmental design can reduce security risk.
- Authorized personnel should be clearly distinguished from unauthorized visitors.
- Badge system - Identification and access card system.
- Gate entry - Controlled entry point.
- CCTV - Camera monitoring system.
- Alarm system - Detects and alerts on unauthorized access.
- Mantrap - Controlled space with two doors to restrict entry.
- Tailgating - Following an authorized person into a restricted area.
- Visitor log - Record of visitors and access details.
- Identify physical controls in an office building.
- Explain how tailgating can bypass access control.
- Create a visitor access procedure.
- Why are physical controls part of cybersecurity?
- What is tailgating?
- How does CCTV support security?
- Why are visitor logs useful?
- What is a mantrap?
Logical access controls manage access to systems, applications, networks, and data. They help ensure that only authorized users can perform approved actions.
- Identification claims an identity.
- Authentication proves identity.
- Authorization grants access based on permissions.
- Accounting records user activity.
- Least privilege gives users only the access needed.
- Separation of duties prevents one person from having too much control.
- Identification - Claiming who you are.
- Authentication - Proving who you are.
- Authorization - Determining what you can access.
- Accounting - Recording what actions were performed.
- AAA - Authentication, Authorization, and Accounting.
- Least privilege - Minimum access required.
- Separation of duties - Splitting sensitive tasks across multiple people.
- Explain identification, authentication, and authorization using login examples.
- Identify least privilege violations in sample user access lists.
- Explain why accounting logs matter for investigations.
- What is the difference between authentication and authorization?
- What does accounting provide?
- Why is least privilege important?
- What is separation of duties?
- What does AAA stand for?
Identity and Access Management, or IAM, manages user accounts, roles, permissions, authentication, and account lifecycle. IAM helps organizations control who has access to what.
- User provisioning creates accounts and assigns access.
- Deprovisioning removes access when no longer needed.
- Privileged accounts need stronger controls.
- MFA reduces the risk of stolen passwords.
- Password policies should support strong authentication.
- Access reviews verify that permissions are still appropriate.
- IAM - Identity and Access Management.
- Provisioning - Creating access.
- Deprovisioning - Removing access.
- Privileged account - Account with elevated permissions.
- MFA - Multi-factor authentication.
- Access review - Periodic check of user permissions.
- Orphaned account - Account no longer tied to a valid user.
- Build a joiner, mover, leaver access checklist.
- Identify risks from stale or orphaned accounts.
- List controls for privileged administrator accounts.
- Why is deprovisioning important?
- What is a privileged account?
- Why are access reviews needed?
- How does MFA reduce account risk?
- What is an orphaned account?
Access control models define how permissions are assigned and enforced. The CC exam expects basic understanding of common models and when they are used.
- DAC gives resource owners control over access.
- MAC uses centrally managed security labels.
- RBAC grants permissions based on job roles.
- ABAC grants access based on attributes such as user, resource, action, and context.
- Rule-based access uses defined rules such as time, location, or network condition.
- DAC - Discretionary Access Control.
- MAC - Mandatory Access Control.
- RBAC - Role-Based Access Control.
- ABAC - Attribute-Based Access Control.
- Rule-based access - Access controlled by predefined rules.
- Permission - Approved action on a resource.
- Match DAC, MAC, RBAC, and ABAC to examples.
- Explain why RBAC is common in organizations.
- Identify access rules for remote login.
- Which model is based on job roles?
- Which model uses centrally controlled labels?
- Which model lets owners manage access?
- Which model uses attributes and context?
- Why is RBAC easier to manage than assigning access user by user?
- I can explain physical access controls.
- I understand monitoring, badges, CCTV, alarms, and visitor logs.
- I can explain identification, authentication, authorization, and accounting.
- I understand least privilege and separation of duties.
- I can describe IAM account lifecycle.
- I understand privileged account risk.
- I can compare DAC, MAC, RBAC, ABAC, and rule-based access.
Access control protects systems, data, and physical spaces by ensuring only authorized users can access approved resources. Strong access control uses physical safeguards, logical permissions, IAM processes, MFA, least privilege, access reviews, and appropriate access control models.