ISC2 CC Access Controls Concepts Practice Question
A defense contractor classifies documents as Public, Internal, Secret, and Top Secret. A user with Secret clearance attempts to open a Top Secret document and is denied, while a user with Top Secret clearance can open both Top Secret and Secret documents. Which access control model does this behavior describe?
⚠ Common exam trap
The trap here is treating any hierarchical permission scheme as role-based access control when the deciding factor is actually data classification labels.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Mandatory access control, because access is determined by comparing the subject's clearance to the object's classification label.
Mandatory access control relies on sensitivity labels attached to objects and clearances assigned to subjects, with the system enforcing the relationship. A subject may read an object only when their clearance dominates the object's classification, which is exactly why Secret cannot reach Top Secret and Top Secret can reach Secret. Users cannot alter these labels, making enforcement mandatory rather than discretionary.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Rule-based access control, because a fixed rule set decides every access request.
Why it's wrong here
Rule-based access control evaluates administrator-defined conditions such as time of day or network address, and it is often associated with network devices. While classification decisions can be expressed as rules, the defining feature here is the hierarchical comparison of clearance to classification. The scenario describes a lattice model, not generic conditional rules.
- ✗
Role-based access control, because permissions follow the user's assigned job role.
Why it's wrong here
Role-based access control grants permissions based on organizational roles rather than data classification levels. The scenario hinges on clearance levels relative to document sensitivity, and the denial occurs purely because of the classification mismatch. No role assignment is mentioned, so role-based access control does not explain the observed behavior.
- ✓
Mandatory access control, because access is determined by comparing the subject's clearance to the object's classification label.
Why this is correct
Mandatory access control bases every decision on labels assigned to subjects and objects, and the operating system enforces those labels regardless of user intent. Clearance must dominate classification for read access, which explains why Secret cannot read Top Secret while Top Secret can read Secret. This label-driven dominance rule is the hallmark of mandatory access control.
- ✗
Discretionary access control, because the document owner decides who may read each file.
Why it's wrong here
Discretionary access control lets data owners set permissions at their discretion, typically through access control lists. In this scenario the denial stems from a system-enforced clearance comparison, not an owner's choice, and users cannot override the decision. The centralized, label-based enforcement described is the opposite of discretionary control.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Access Control Fundamentals
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
One of 989 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.