easyMultiple ChoiceObjective-mapped
CISSP Practice Question: A security architect is selecting an access…
A security architect is selecting an access control model for a system that must prevent users from reading objects at a higher classification level. Which model enforces this property?
⚠ Common exam trap
Many candidates confuse the Biba model (integrity, no read-down) with Bell-LaPadula (confidentiality, no read-up), so they incorrectly select Biba when the question explicitly asks about preventing reading at a higher classification level.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Bell-LaPadula
The Bell-LaPadula model enforces mandatory access control (MAC) with the *-property (no write-down) and the simple security property (no read-up). The question specifically asks to prevent reading objects at a higher classification level, which is exactly the 'no read-up' rule of Bell-LaPadula. This model is designed for confidentiality-focused systems, such as military or government classified environments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Bell-LaPadula
Why this is correct
The Bell-LaPadula model is a state machine model primarily concerned with confidentiality, designed to prevent unauthorized disclosure of information. It enforces the "simple security property" (no read-up) and the "*-property" (no write-down), ensuring that subjects at a given security level cannot read objects at a higher level or write to objects at a lower level. This strict hierarchical control is ideal for environments where preventing unauthorized disclosure of classified information is paramount, such as military or government systems requiring multi-level security.
- ✗
Clark-Wilson
Why it's wrong here
The Clark-Wilson model is an integrity-focused access control model designed to prevent unauthorized modification of data and maintain data consistency. It achieves this through well-formed transactions, which are enforced by transformation procedures (TPs) that operate on constrained data items (CDIs). This model also emphasizes separation of duties and auditing, making it suitable for commercial applications where data integrity and prevention of fraud are critical, rather than confidentiality requirements.
- ✗
Biba
Why it's wrong here
The Biba integrity model is specifically designed to prevent data corruption and maintain data integrity, often considered the inverse of Bell-LaPadula. It enforces the "simple integrity property" (no read-down) and the "integrity *-property" (no write-up), meaning subjects cannot read data at a lower integrity level or write to data at a higher integrity level. This prevents subjects from contaminating higher integrity data with lower integrity information, making it unsuitable for confidentiality requirements.
- ✗
Brewer-Nash
Why it's wrong here
The Brewer-Nash model, also known as the Chinese Wall model, is designed to prevent conflicts of interest by dynamically changing access permissions based on a subject's previous access history. Once a subject accesses information related to one company within a conflict-of-interest dataset, they are then prevented from accessing information related to competing companies within that same dataset. This model is not concerned with hierarchical classification-based confidentiality, but rather with preventing specific types of information disclosure that could lead to ethical or financial conflicts.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
MAC
MAC (Media Access Control) is a unique hardware identifier assigned to network interfaces for communication on a local network segment.
Key term
Bell-LaPadula
A formal security model that prevents users from reading information at a higher classification level than their own and from writing information down to a lower classification level.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.