CISSP Security Architecture and Engineering Practice Question
A security analyst is evaluating access control models for a healthcare organization that needs to enforce both confidentiality and integrity. Which TWO models should be considered? Select two.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Bell-LaPadula
Bell-LaPadula enforces confidentiality; Biba enforces integrity. Together they address both requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Take-Grant
Why it's wrong here
The Take-Grant model is a formal access control model focused on the propagation of access rights within a system. It uses a graph-based approach to determine how subjects can acquire or transfer rights to objects, or even to other subjects. While useful for analyzing the flow of privileges and potential for privilege escalation, it does not inherently enforce specific confidentiality (e.g., preventing unauthorized disclosure) or integrity (e.g., preventing unauthorized modification) policies directly through its core rules.
- ✓
Bell-LaPadula
Why this is correct
The Bell-LaPadula model is a state-machine model primarily designed to enforce confidentiality, particularly in military and government systems. It operates on the principles of 'no read up' (Simple Security Property) and 'no write down' (*-property), ensuring that subjects can only access information at or below their security clearance level and cannot write information to a lower security level. This prevents unauthorized disclosure of classified information by strictly controlling information flow.
- ✓
Biba
Why this is correct
The Biba model is a formal state-machine model specifically designed to enforce integrity, often considered the inverse of Bell-LaPadula. Its core principles are 'no read down' (Simple Integrity Axiom) and 'no write up' (*-Integrity Axiom), meaning subjects can only read data at or above their integrity level and can only write to data at or above their integrity level. This prevents subjects from corrupting data at a higher integrity level and ensures data quality by restricting information flow from lower-integrity sources.
- ✗
Clark-Wilson
Why it's wrong here
The Clark-Wilson model is an integrity model that focuses on well-formed transactions and separation of duties to maintain data integrity, particularly in commercial applications. It employs constrained data items (CDIs), transformation procedures (TPs), and user-defined procedures (UDPs) to ensure data is modified only in authorized ways by authorized users. While highly effective for ensuring data accuracy and preventing fraud, it does not include mechanisms to enforce confidentiality based on classification levels or prevent unauthorized information disclosure.
- ✗
Brewer-Nash
Why it's wrong here
The Brewer-Nash model, also known as the Chinese Wall model, is designed to prevent conflicts of interest by dynamically changing access permissions based on a subject's prior access history. Its primary goal is to ensure that a subject cannot access information from competing companies or datasets once they have accessed information from one. This model does not directly enforce general confidentiality (like Bell-LaPadula) or integrity (like Biba), but rather manages access to prevent specific ethical or business conflicts.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Bell-LaPadula
A formal security model that prevents users from reading information at a higher classification level than their own and from writing information down to a lower classification level.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.