CISSP Security Architecture and Engineering Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Mandatory Access Control (MAC)

  Why it's wrong here

  Mandatory Access Control (MAC) is a highly structured access control model where access decisions are centrally enforced by the operating system or security kernel, not by the resource owner. It relies on security labels assigned to subjects (users/processes) and objects (files/resources), representing their sensitivity and clearance levels. Access is granted only when a subject's clearance level meets or exceeds the object's sensitivity level, preventing any user, including the owner, from overriding these system-wide security policies.

• ✓

  Discretionary Access Control (DAC)

  Why this is correct

  Discretionary Access Control (DAC) is the correct model because it empowers the resource owner to define and modify access permissions for the resources they own. Under DAC, the owner can grant or revoke specific access rights (e.g., read, write, execute) to other users or groups, typically through mechanisms like Access Control Lists (ACLs) or permission bits. This model provides flexibility by allowing individual users to manage access to their own data and files, making it prevalent in many common operating systems.

• ✗

  Attribute-Based Access Control (ABAC)

  Why it's wrong here

  Attribute-Based Access Control (ABAC) determines access rights dynamically by evaluating policies that combine various attributes of the subject (e.g., user's role, department), object (e.g., data sensitivity, type), and environment (e.g., time of day, location). Unlike DAC, ABAC does not rely on the resource owner's direct discretion to set permissions; instead, access is granted or denied based on whether these attributes satisfy predefined policy rules. This model offers fine-grained, context-aware access control but shifts the control from the owner to policy administrators.

• ✗

  Role-Based Access Control (RBAC)

  Why it's wrong here

  Role-Based Access Control (RBAC) assigns permissions to specific organizational roles rather than directly to individual users or resources. Users are then granted access to resources by being assigned to one or more roles, inheriting all permissions associated with those roles. The resource owner does not directly control who accesses their resource; instead, access is mediated by the roles defined by system administrators. This model simplifies management in large organizations and supports the principle of least privilege by centralizing permission management.

Go deeper

Related to this question