SSCP Access Controls Practice Question
A security team is reviewing access control models for a new document management system. The system must support discretionary sharing where document owners can grant access to other users, but it must also enforce a mandatory rule that any document labeled 'Confidential' cannot be accessed by users without a 'Confidential' clearance, regardless of owner intent. Which access control model best satisfies both requirements?
⚠ Common exam trap
The trap here is assuming that DAC alone can enforce mandatory restrictions, when in fact DAC permissions can be overridden by users with ownership rights.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A hybrid approach combining DAC and MAC
The scenario requires both discretionary sharing by owners and mandatory enforcement of confidentiality labels. DAC provides the former but not the latter, while MAC provides the latter but not the former. A hybrid approach that layers MAC enforcement over DAC permissions meets both requirements simultaneously, which is why it is the correct choice.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Mandatory Access Control (MAC)
Why it's wrong here
MAC enforces access based on security labels and clearances, which satisfies the mandatory confidentiality rule. However, MAC does not permit discretionary sharing by resource owners; all access is governed by system policy. Since the scenario requires owners to grant access discretionarily, MAC alone fails to meet that requirement.
- ✗
Discretionary Access Control (DAC)
Why it's wrong here
DAC allows resource owners to grant access at their discretion, satisfying the sharing requirement. However, DAC cannot enforce a mandatory rule that overrides owner intent, such as preventing access to Confidential documents by users lacking clearance. Because the mandatory rule must be enforced regardless of owner decisions, DAC alone is insufficient.
- ✗
Role-Based Access Control (RBAC)
Why it's wrong here
RBAC assigns permissions based on organizational roles rather than individual owner discretion. While it can enforce clearance-like restrictions through role assignments, it does not natively support discretionary sharing where owners grant access to specific users. The requirement for owner-controlled sharing is not met by RBAC alone, making it unsuitable for this combined scenario.
- ✓
A hybrid approach combining DAC and MAC
Why this is correct
A hybrid model allows owners to grant discretionary access while also enforcing mandatory label-based restrictions. This satisfies both the need for owner-controlled sharing and the requirement that Confidential documents remain inaccessible to users without proper clearance. No single traditional model provides both capabilities, so combining them is necessary.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.