mediumMultiple ChoiceObjective-mapped
CISSP Practice Question: A government agency requires a new secure…
A government agency requires a new secure document management system that enforces mandatory access control with the properties that users cannot read documents at a higher classification and cannot write documents to a lower classification (to prevent data leaking). The system must also support different categories (compartments) within the same classification level, and a user with access to one compartment should not be able to access another compartment unless explicitly allowed. The architect is considering the Bell-LaPadula model. However, the Bell-LaPadula model's *-property (no write-down) addresses the write issue, but there is also a need to handle compartment isolation. Which additional model or mechanism should be incorporated to ensure compartment isolation?
⚠ Common exam trap
Watch out — candidates often confuse the Brewer-Nash model's dynamic separation of duties with the static, lattice-based compartment isolation required by MAC, or incorrectly assume that Biba's integrity model can somehow enforce confidentiality-based compartment boundaries.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a lattice-based access control (LBAC) that extends Bell-LaPadula by defining a security lattice that includes compartments and categories, ensuring that a subject's clearance must dominate the object's classification, including compartments.
Lattice-based access control (LBAC) extends the Bell-LaPadula model by defining a security lattice that includes both hierarchical classifications (e.g., Top Secret, Secret) and non-hierarchical categories (compartments). In this lattice, a subject's clearance must dominate an object's classification across both dimensions, ensuring that a user with access to one compartment cannot access another unless their clearance includes that specific category. This directly enforces the required compartment isolation while maintaining the *-property (no write-down) for data leakage prevention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Apply the Brewer-Nash (Chinese Wall) model which enforces conflict of interest by preventing access to multiple compartments that conflict.
Why it's wrong here
The Brewer-Nash (Chinese Wall) model is designed to prevent dynamic conflicts of interest, typically in financial or consulting environments, by ensuring a user cannot access information from competing clients. It dynamically restricts access based on prior access history to prevent a user from breaching ethical walls, rather than defining static, hierarchical compartment isolation for secure document management in a government agency.
- ✗
Implement Biba's integrity model which prevents write-up, thus complementing Bell-LaPadula.
Why it's wrong here
Biba's integrity model focuses on preventing unauthorized modification of data by enforcing 'no write-up' (a subject cannot write to an object of higher integrity) and 'no read-down' (a subject cannot read an object of lower integrity). While crucial for data integrity, it does not inherently define or manage confidentiality-based compartments or enforce multi-level security for document access based on subject clearance and object classification.
- ✓
Use a lattice-based access control (LBAC) that extends Bell-LaPadula by defining a security lattice that includes compartments and categories, ensuring that a subject's clearance must dominate the object's classification, including compartments.
Why this is correct
Lattice-based access control (LBAC) is a powerful mandatory access control (MAC) model that extends Bell-LaPadula by incorporating multiple, non-hierarchical compartments (e.g., 'Nuclear,' 'Space,' 'Cyber') alongside hierarchical classification levels. It defines a security lattice where a subject's clearance must 'dominate' an object's classification, meaning the subject must possess all required classification levels and *all* specified compartments to gain access, precisely addressing the need for fine-grained compartment isolation.
- ✗
Use role-based access control (RBAC) to define compartments.
Why it's wrong here
Role-based access control (RBAC) assigns permissions to roles, and users are assigned to roles, simplifying administration based on job functions. However, RBAC is a discretionary access control (DAC) model, or at best, a non-mandatory form of access control. It does not inherently enforce the strict, non-discretionary hierarchical and compartmentalized security policies typically required by government agencies, where access is based on object sensitivity and subject clearance, not just job function.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
Key term
Bell-LaPadula
A formal security model that prevents users from reading information at a higher classification level than their own and from writing information down to a lower classification level.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.