CISSP Security Architecture and Engineering Practice Question
A security architect is designing a system for a military intelligence agency where data classification labels (Top Secret, Secret, Confidential, Unclassified) are mandatory. Users are cleared to a specific level and must not read data above their clearance. Which security model enforces this type of access control?
⚠ Common exam trap
CISSP often tests the classic confidentiality-versus-integrity confusion, so the trap is choosing Biba when the scenario describes classification labels and clearance-based reading restrictions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Bell-LaPadula model
The Bell-LaPadula model is a mandatory access control (MAC) model built around data confidentiality, using security labels and clearances so that subjects cannot read data above their clearance (no read up) and cannot write data below their level (no write down). This exactly matches the military classification scenario where Top Secret, Secret, Confidential, and Unclassified labels are mandatory and users are cleared to a specific level.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Bell-LaPadula model
Why this is correct
The Bell-LaPadula model is a state machine model primarily designed to enforce strict confidentiality in multi-level security environments, making it ideal for military systems handling classified information. It operates on two core rules: the "simple security property" (no read up), preventing subjects from reading data at a higher classification level, and the "*-property" (no write down), preventing subjects from writing data to a lower classification level. These rules ensure that information flows only upwards, effectively protecting classified data from unauthorized disclosure.
- ✗
Biba model
Why it's wrong here
The Biba model is an integrity-focused access control model, contrasting directly with confidentiality models like Bell-LaPadula, and is not suitable when confidentiality is the primary concern. Its primary goal is to prevent data corruption by enforcing two key rules: the "simple integrity property" (no read down), which prevents subjects from reading data at a lower integrity level, and the "*-integrity property" (no write up), which prevents subjects from writing to a higher integrity level. This ensures that high-integrity data is not contaminated by low-integrity data, making it suitable for systems where data accuracy is paramount.
- ✗
Brewer-Nash model
Why it's wrong here
The Brewer-Nash model, also known as the Chinese Wall model, is designed to prevent conflicts of interest by dynamically adjusting access permissions based on a subject's prior access history. It ensures that a user who has accessed information related to one client or company cannot subsequently access information related to a competing client or company within the same conflict-of-interest class. This model is distinct from classification-based models as it focuses on ethical separation and preventing information flow between competing entities, rather than strict hierarchical confidentiality levels.
- ✗
Clark-Wilson model
Why it's wrong here
The Clark-Wilson model is an integrity model specifically tailored for commercial applications, emphasizing well-formed transactions and separation of duties to maintain data consistency and prevent fraud. It uses constrained data items (CDIs) that can only be modified by certified transformation procedures (TPs), which are subject to integrity verification procedures (IVPs) and certification rules. This robust framework ensures that data integrity is preserved through controlled operations, preventing unauthorized or erroneous modifications in business processes.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Asset Security: Classification and Handling
Key term
MAC
MAC (Media Access Control) is a unique hardware identifier assigned to network interfaces for communication on a local network segment.
Key term
Bell-LaPadula
A formal security model that prevents users from reading information at a higher classification level than their own and from writing information down to a lower classification level.
About these practice questions
Courseiva writes every CISSP question from scratch — 816 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.