SSCP Access Controls Practice Question
A hospital uses a MAC-based system where data labels carry classifications such as Restricted and Public, and user clearances are assigned by the security office. A nurse with a Secret-equivalent clearance attempts to read a patient record labeled with a higher classification. According to the Bell-LaPadula model, what should occur?
⚠ Common exam trap
The trap here is treating a legitimate business need as sufficient authorization, when mandatory access control models decide access purely from clearance and label relationships.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The read is denied because no-read-up prevents reading higher-classified data
Bell-LaPadula enforces confidentiality through the simple security property, which forbids a subject from reading an object at a higher classification than the subject's clearance. Since the nurse's clearance is below the record's label, the read is denied. Business need, logging, and encryption do not alter the mandatory clearance comparison that drives the access decision.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The read is permitted because the nurse is accessing the record over an encrypted channel
Why it's wrong here
Encryption protects data in transit but does not change the classification relationship between subject and object. Bell-LaPadula's no-read-up rule is evaluated on clearance and label, independent of transport security. A lower-cleared subject still cannot read a higher-labeled object even over a secure channel. Encryption is a complementary safeguard, not a mechanism for bypassing mandatory access decisions, so this reasoning misapplies the model.
- ✓
The read is denied because no-read-up prevents reading higher-classified data
Why this is correct
Bell-LaPadula's simple security property, often called no-read-up, states that a subject cannot read an object with a classification higher than the subject's clearance. The nurse's clearance is lower than the record's label, so the read must be denied. This preserves confidentiality by preventing lower-cleared subjects from accessing more sensitive data, even when they have a legitimate operational reason to see it.
- ✗
The read is allowed but only if the nurse first writes a justification to the audit log
Why it's wrong here
Audit logging is a detective control and does not grant access that the mandatory model prohibits. Bell-LaPadula evaluates the clearance-to-label relationship before any logging occurs, and a lower clearance cannot be remedied by documenting intent. While logging would be appropriate for allowed access, it cannot convert a prohibited read into a permitted one. The correct behavior is to deny the request outright and route it through a formal clearance or declassification process.
- ✗
The read is allowed because the nurse has a legitimate business need
Why it's wrong here
Business need is a discretionary consideration and does not override mandatory access control rules. Bell-LaPadula's no-read-up property prohibits a subject from reading an object at a higher classification regardless of job function. Allowing the read because of business need would violate the mandatory nature of the model, where clearance levels and object labels, not user intent, determine access. The security office would need to raise the clearance or lower the label instead.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.