Home > Glossary > CompTIA Security+ Certification Exam > Discretionary Access Control (DAC)

📖 What is Discretionary Access Control (DAC)?

Discretionary Access Control (DAC) is a type of access control where the owner of the resource determines who is granted access. It allows the owner to pass permissions to other users at their own discretion, making it flexible but less secure than centralized models.

🥋 Sensei Says:

"Watch out for the word 'discretion.' In DAC, the user (owner) has the power, which makes it the least restrictive and most prone to security gaps."

📚 Certification: CompTIA Security+ Certification Exam (SY0-701)

🔑 What are the Key Concepts of Discretionary Access Control (DAC)?

▸ Resource ownership is the core principle, where the creator of a file or folder is the owner and manages all access permissions.
▸ Implementation typically relies on Access Control Lists (ACLs) to define specific permissions like read, write, and execute for individual users or groups.
▸ It provides maximum flexibility for users to share data quickly without requiring administrative intervention for every single permission change.
▸ DAC is inherently less secure than MAC because it allows users to bypass centralized security policies by granting access at their discretion.

🎯 How does Discretionary Access Control (DAC) appear on the SY0-701 Exam?

You may be asked to identify the access control model in a scenario where a user creates a document and manually grants 'Read' access to a coworker, illustrating that the owner controls the permissions.

A scenario might describe a high-security government environment requiring strict, non-bypassable labels for data classification; you will need to recognize why DAC is inappropriate here due to its decentralized nature.

❓ Frequently Asked Questions

How does DAC differ from Role-Based Access Control (RBAC)?

DAC is based on individual ownership and user discretion, whereas RBAC assigns permissions to roles (like 'Manager' or 'HR') and then assigns users to those roles, centralizing management.

What is the primary security risk associated with using DAC?

The main risk is 'permission creep' or unauthorized data exposure, as owners may grant excessive permissions to others who then pass those permissions further, bypassing central security oversight.

Related Terms from CompTIA Security+ Certification Exam

Recovery Time Objective (RTO) Security Operations Center (SOC) Privileged Access Management (PAM) Risk Appetite Wireless Intrusion Prevention System (WIPS) Authentication

📝 Related Study Guides

Study Guide 9 min read

How to Pass CompTIA Security+ (SY0-701) on Your First Try

To pass CompTIA Security+ SY0-701 on your first try, build a structured 6-8 week study plan covering all five domains, prioritize understanding concepts over memorization, practice with scenario-based questions daily, and consistently score 85% or higher on practice exams before scheduling your test. Hands-on lab experience is essential for performance-based questions.

Deep Dive 8 min read

Zero Trust Architecture: Security+ (SY0-701) Deep Dive

Zero Trust architecture is a security framework based on the principle "never trust, always verify." Unlike traditional perimeter security, it assumes breaches are inevitable and requires strict identity verification for every person and device attempting to access resources, regardless of whether they are inside or outside the network perimeter.

Exam Tips 8 min read

Security+ PBQs: Master Firewall ACLs & Incident Response

Security+ Performance-Based Questions (PBQs) are scenario-driven simulations requiring you to apply knowledge to real-world tasks. To master them, focus on firewall ACL rule ordering, the "implicit deny" principle, and analyzing system logs for incident response. Consistent practice with high-fidelity simulations is the most effective way to ensure exam success.