CISSP Security Architecture and Engineering Practice Question
A security architect is designing a system for a military intelligence agency where data classification labels (Top Secret, Secret, Confidential, Unclassified) are mandatory. Users are cleared to a specific level and must not read data above their clearance. Which security model enforces this type of access control?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Bell-LaPadula model
Bell-LaPadula focuses on confidentiality and enforces no read up (simple security property) and no write down (*-property), matching the scenario's need to prevent reading higher classified data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Bell-LaPadula model
Why this is correct
The Bell-LaPadula model is a state machine model primarily designed to enforce strict confidentiality in multi-level security environments, making it ideal for military systems handling classified information. It operates on two core rules: the "simple security property" (no read up), preventing subjects from reading data at a higher classification level, and the "*-property" (no write down), preventing subjects from writing data to a lower classification level. These rules ensure that information flows only upwards, effectively protecting classified data from unauthorized disclosure.
- ✗
Biba model
Why it's wrong here
The Biba model is an integrity-focused access control model, contrasting directly with confidentiality models like Bell-LaPadula, and is not suitable when confidentiality is the primary concern. Its primary goal is to prevent data corruption by enforcing two key rules: the "simple integrity property" (no read down), which prevents subjects from reading data at a lower integrity level, and the "*-integrity property" (no write up), which prevents subjects from writing to a higher integrity level. This ensures that high-integrity data is not contaminated by low-integrity data, making it suitable for systems where data accuracy is paramount.
- ✗
Brewer-Nash model
Why it's wrong here
The Brewer-Nash model, also known as the Chinese Wall model, is designed to prevent conflicts of interest by dynamically adjusting access permissions based on a subject's prior access history. It ensures that a user who has accessed information related to one client or company cannot subsequently access information related to a competing client or company within the same conflict-of-interest class. This model is distinct from classification-based models as it focuses on ethical separation and preventing information flow between competing entities, rather than strict hierarchical confidentiality levels.
- ✗
Clark-Wilson model
Why it's wrong here
The Clark-Wilson model is an integrity model specifically tailored for commercial applications, emphasizing well-formed transactions and separation of duties to maintain data consistency and prevent fraud. It uses constrained data items (CDIs) that can only be modified by certified transformation procedures (TPs), which are subject to integrity verification procedures (IVPs) and certification rules. This robust framework ensures that data integrity is preserved through controlled operations, preventing unauthorized or erroneous modifications in business processes.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Data classification
Data classification is the process of organizing data into categories based on its sensitivity, value, and criticality to an organization, so that appropriate security controls can be applied.
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.