CISSP Security Architecture and Engineering Practice Question
A security architect is designing a system for a government agency that requires strict confidentiality controls. Data must be classified at multiple levels (e.g., Top Secret, Secret, Confidential). Users at a lower classification should not be able to read data at a higher classification, and users at a higher classification should not be able to write data to a lower classification. Which security model enforces these rules?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Bell-LaPadula model
The Bell-LaPadula model is a state machine model focused on confidentiality. It enforces 'no read up' and 'no write down' to prevent unauthorized access to higher classification data and prevent downgrading of classified information.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Biba model
Why it's wrong here
The Biba model is an integrity-focused access control model designed to prevent unauthorized modification of data. It enforces two primary rules: the Simple Integrity Property ("no read down") and the *-Integrity Property ("no write up"). This model prioritizes data trustworthiness and accuracy, making it unsuitable for a government system primarily concerned with protecting the secrecy of information rather than its integrity from corruption.
- ✗
Clark-Wilson model
Why it's wrong here
The Clark-Wilson model is an integrity model primarily used in commercial environments, emphasizing well-formed transactions and separation of duties to maintain data consistency. It uses Constrained Data Items (CDIs) and Unconstrained Data Items (UDIs) with Transformation Procedures (TPs) to ensure only authorized operations modify data. While excellent for preventing fraud and errors, its focus on data integrity through controlled processes does not directly address the confidentiality requirements of a government system.
- ✗
Brewer-Nash model
Why it's wrong here
The Brewer-Nash model, also known as the Chinese Wall model, is designed to prevent conflicts of interest by dynamically adjusting access rights based on a subject's past actions. Once a subject accesses information from one company within a conflict-of-interest group, they are prevented from accessing information from any other company in that same group. While crucial for certain business scenarios, this model's specific purpose is not the general confidentiality enforcement required for a government system's classified information.
- ✓
Bell-LaPadula model
Why this is correct
The Bell-LaPadula model is a state machine model designed specifically to enforce confidentiality in systems handling classified information, such as those used by governments. It prevents unauthorized disclosure by implementing two core rules: the Simple Security Property ("no read up") and the *-Property ("no write down"). These rules ensure that subjects can only access information at or below their security clearance level and cannot write information to a lower security level, thus preventing information flow to less secure domains.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Bell-LaPadula
A formal security model that prevents users from reading information at a higher classification level than their own and from writing information down to a lower classification level.
Key term
Security model
A security model is a formal framework that defines how subjects (users, processes) can access objects (files, resources) based on rules, ensuring confidentiality, integrity, and availability.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.