SSCP Access Controls Practice Question
A small business owner wants to implement access control for a shared folder on a Windows server. The owner wants to grant different permissions to individual employees based on their specific job duties, without creating groups. Which access control model is most appropriate?
⚠ Common exam trap
The trap here is overcomplicating the solution by choosing a more complex model like ABAC or RBAC, when the simple requirement points to DAC.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Discretionary access control (DAC)
Discretionary access control (DAC) is the model where the owner of a resource determines who can access it and with what permissions. In this scenario, the small business owner wants to grant individual permissions to employees based on their job duties without creating groups. DAC allows this flexibility. RBAC would require roles, MAC uses labels, and ABAC uses attributes, all of which are more complex or not aligned with the owner's direct control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Discretionary access control (DAC)
Why this is correct
DAC allows the owner of a resource to grant permissions to individual users at their discretion. This matches the owner's requirement to assign different permissions to employees based on job duties without using groups. DAC is the most appropriate model here.
- ✗
Attribute-based access control (ABAC)
Why it's wrong here
ABAC uses attributes (such as user department, time of day, etc.) to make access decisions, which can be complex to set up. While ABAC can grant granular access, it is overkill for a small business owner wanting simple individual permissions. DAC is simpler and more direct for this scenario.
- ✗
Role-based access control (RBAC)
Why it's wrong here
RBAC assigns permissions based on roles, not individual users. The owner wants to grant permissions to individual employees without creating groups, so RBAC is not the best fit. RBAC would require defining roles and assigning users to them, which contradicts the requirement for individual assignments.
- ✗
Mandatory access control (MAC)
Why it's wrong here
MAC uses labels and clearances to enforce access, which is more rigid and typically used in high-security environments. It does not allow the owner to grant permissions to individuals based on job duties. MAC is not appropriate for a small business owner wanting flexible, individual permissions.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 971-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.