easyMultiple ChoiceObjective-mapped
CISSP Practice Question: A health records system requires that doctors can…
A health records system requires that doctors can write new records but cannot modify existing ones, and integrity is maintained through separation of duties. Which security model best fits this requirement?
⚠ Common exam trap
Watch out — candidates often confuse the Biba model with integrity enforcement, but Biba only prevents unauthorized data flow based on integrity levels, not the specific separation of duties and well-formed transaction constraints that Clark-Wilson provides for this scenario.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Clark-Wilson
The Clark-Wilson model enforces integrity through well-formed transactions and separation of duties, which directly matches the requirement that doctors can write new records but cannot modify existing ones. It uses constrained data items (CDIs), transformation procedures (TPs), and integrity verification procedures (IVPs) to ensure that only authorized users can perform specific operations, preventing unauthorized modifications.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Brewer-Nash
Why it's wrong here
The Brewer-Nash model, also known as the Chinese Wall policy, is designed to prevent conflicts of interest by restricting a subject's access to information that would create such a conflict. It ensures that once a subject accesses information from one 'company dataset,' they are prevented from accessing competing company datasets. This model focuses on information separation to maintain ethical boundaries, rather than enforcing the accuracy or validity of data modifications within a single system, which is an integrity concern.
- ✗
Biba
Why it's wrong here
The Biba integrity model primarily focuses on preventing data corruption by enforcing two strict rules: 'no read up' (a subject cannot read data at a higher integrity level) and 'no write down' (a subject cannot write data to a lower integrity level). While it aims to maintain data integrity by preventing subjects from corrupting data at lower levels, it does not inherently define or enforce specific transformation procedures or separation of duties for *how* data is modified. Therefore, it doesn't directly address the structured process of doctors writing new, well-formed records with specific controls.
- ✓
Clark-Wilson
Why this is correct
The Clark-Wilson integrity model is specifically designed for commercial applications requiring strong data integrity through well-formed transactions and separation of duties. It distinguishes between Constrained Data Items (CDIs) and Unconstrained Data Items (UDIs), enforcing that all modifications to CDIs must occur through certified Transformation Procedures (TPs). These TPs are executed by subjects under strict access control rules, ensuring that data integrity is maintained through controlled operations and preventing unauthorized or erroneous data manipulation, perfectly aligning with the need for doctors to write new, valid health records.
- ✗
Bell-LaPadula
Why it's wrong here
The Bell-LaPadula model is a state machine model primarily concerned with confidentiality, preventing unauthorized disclosure of information. It enforces two fundamental rules: the 'Simple Security Property' (no read up) and the '*-Property' (no write down), ensuring that subjects can only access information at or below their security clearance level. This model is not designed to guarantee the accuracy or validity of data itself, nor does it provide mechanisms for structured data modification or separation of duties, making it unsuitable for the integrity requirements of writing new health records.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security model
A security model is a formal framework that defines how subjects (users, processes) can access objects (files, resources) based on rules, ensuring confidentiality, integrity, and availability.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.