CISSP Security Architecture and Engineering Practice Question
Which access control model allows the data owner to determine who can access their resources, typically using Access Control Lists (ACLs)?
⚠ Common exam trap
CISSP often tests the confusion between DAC and RBAC — candidates see 'owner determines access' and think of role owners, but the key discriminator is that DAC grants discretion to the resource owner, not to a role administrator.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Discretionary Access Control (DAC)
Discretionary Access Control (DAC) is defined by the property that the owner of a resource decides who can access it and with what permissions, typically by configuring Access Control Lists (ACLs) on the object. This owner-controlled discretion is the defining characteristic that separates DAC from MAC, RBAC, and ABAC. In DAC systems like Windows NTFS or Unix file permissions, the resource owner can grant or revoke access at will.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Discretionary Access Control (DAC)
Why this is correct
DAC lets the resource owner set permissions themselves, typically through ACLs listing permitted subjects and rights. Authority is discretionary and delegated to the owner, unlike mandatory or role-based models where central policy dictates access regardless of ownership.
- ✗
Role-Based Access Control (RBAC)
Why it's wrong here
RBAC assigns permissions to roles, then users to roles, so access derives from a user's job function rather than the resource owner's per-resource discretion. It is tempting because RBAC scales well for enterprise-wide, function-based entitlements, and would be correct where permissions should follow organisational roles rather than owner-granted ACLs.
- ✗
Mandatory Access Control (MAC)
Why it's wrong here
MAC assigns access by system-enforced labels and clearances, removing owner discretion entirely; ACL-based owner control is the discretionary model. MAC is tempting because it also governs resource access, but its centralised label comparison is the opposite of letting a data owner decide who may read their files.
- ✗
Attribute-Based Access Control (ABAC)
Why it's wrong here
ABAC evaluates attributes of subject, resource and environment through policies, not owner-maintained ACLs, so the data owner does not directly name permitted users. It tempts because attributes can include ownership, yet the model that literally lets owners set ACL entries is Discretionary Access Control.
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Access Control Models and Mechanisms
Key term
ABAC
ABAC (Attribute-Based Access Control) is a method of controlling access to resources by evaluating a set of attributes (such as user role, time, location, and device) against policy rules, rather than using static roles or identities.
Key term
MAC
MAC (Media Access Control) is a unique hardware identifier assigned to network interfaces for communication on a local network segment.
About these practice questions
This CISSP question is part of Courseiva's 816-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.