CISSP Security Architecture and Engineering Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  MAC

  Why it's wrong here

  Mandatory Access Control (MAC) is a highly structured access control model where the operating system or security kernel enforces a system-wide security policy. Access decisions are based on security labels assigned to subjects (users/processes) and objects (files/resources), representing their classification and clearance levels. Data owners have no discretion to grant or revoke access; all permissions are centrally managed and strictly enforced by the system, preventing unauthorized information flow. This model prioritizes confidentiality and integrity in high-security environments.

• ✗

  RBAC

  Why it's wrong here

  Role-Based Access Control (RBAC) grants permissions based on a user's assigned role within an organization, rather than individual identity or object ownership. Permissions are defined for specific roles (e.g., "Administrator," "Auditor," "User"), and users acquire those permissions by being assigned to one or more roles. While administrators manage role assignments, individual data owners do not have the authority to directly grant or revoke access to their data; access is determined by the roles a user holds and the permissions associated with those roles.

• ✗

  ABAC

  Why it's wrong here

  Attribute-Based Access Control (ABAC) makes access decisions dynamically by evaluating a set of attributes associated with the subject (user), object (resource), action (what is being done), and environment (context). A policy engine evaluates these attributes against defined policies to determine access. While ABAC offers highly granular and flexible control, the decision-making logic is based on predefined policies and attribute values, not the direct discretionary authority of a data owner to grant or revoke specific permissions on a per-user basis.

• ✓

  DAC

  Why this is correct

  Discretionary Access Control (DAC) is an access control model where the owner of a resource (or an authorized administrator) has the discretion to grant or revoke access permissions to other users. This is typically implemented using Access Control Lists (ACLs) or capabilities, allowing owners to specify who can perform specific actions (read, write, execute) on their owned objects. DAC is highly flexible and widely used in commercial operating systems because it empowers data owners to manage access to their own data.

Go deeper

Related to this question