What is rule-based access control?
Rule-based access control decides each request by testing it against rules an administrator writes in advance. A rule names conditions, such as source network, destination port, protocol, device compliance or country, and an action, allow or deny. The rules treat everyone who matches them the same way; the system doesn't consider who the person is or what job they hold unless a rule says so. Firewalls, router access control lists, email gateways and cloud conditional access policies all work this way.
How rules are evaluated
Most rule sets are read from the top, and the first rule that matches decides the request. A request that matches nothing falls through to a default, which in a well-built system is deny. That makes rule order a security setting in its own right: a broad allow placed above a narrow deny quietly cancels the deny. These two Linux firewall rules let only the admin subnet reach SSH:
iptables -A INPUT -p tcp -s 10.20.0.0/24 --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j DROP
Any host in 10.20.0.0/24 gets through and every other source is dropped, no matter which user is typing.
Where rule-based control shows up
- Network firewalls, cloud security groups and router ACLs that filter by address, port and protocol.
- Conditional access in cloud identity platforms: block sign-ins from countries with no staff, or require a compliant device to open email.
- Email and web gateways that block certain attachment types or site categories for everyone.
- Application rules, such as refusing any payment above a set amount without a second approver.
Rule-based vs. role-based access control
The two share the abbreviation RBAC, so the spelled-out name in a question is what counts. Role-based access control asks what job the user holds and grants the permissions attached to that role. Rule-based access control asks whether the request meets the conditions and gives the same answer to everyone in scope. Most environments layer them: a role grants help desk staff the password-reset tool, and a rule limits that tool to connections from the internal network.
Rule-based vs. time-based and attribute-based control
A time-of-day restriction is technically a rule, but SY0-801 lists time-based access control as its own model, so a question built around a schedule, such as logon hours or a badge that works only during a shift, wants time-based. Attribute-based access control (ABAC) extends the rule idea, combining attributes of the person, the resource and the situation in one policy, such as department, data sensitivity and device health. Cloud platforms use it widely, but it is not among the models SY0-801 lists.
Rule-based access control on the CompTIA Security+ exam
Rule-based access control is one of the six access control models in SY0-801 objective 4.5. Scenario wording such as conditions applied to all users, an ACL, a firewall rule set, or access blocked from a particular network or country points to it. The main distractor is role-based access control, which depends on job function, followed by mandatory access control (labels and clearances), discretionary access control (the owner decides) and time-based access control (a schedule). Questions about rule order, implicit deny or a rule hidden below a broader one test the same model from the firewall side.