SSCP Access Controls Practice Question
A small business owner wants to implement access control for a shared file server. The owner wants each department manager to be able to decide which of their employees can access specific folders, without involving the IT department for every change. Which access control model is most appropriate for this requirement?
⚠ Common exam trap
The trap here is assuming that any model allowing managers some control is DAC, when in fact only DAC gives resource owners full discretion to set permissions on their own resources.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Discretionary access control (DAC)
Discretionary access control (DAC) lets resource owners decide who can access their resources, which directly supports the requirement for department managers to control access to their folders without IT involvement. MAC, RBAC, and ABAC are more centralized or policy-driven and do not offer this level of delegated, owner-controlled discretion.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Mandatory access control (MAC)
Why it's wrong here
MAC requires a central authority to assign labels and enforce access, which would not allow department managers to make independent decisions. It is rigid and typically used in high-security environments. The small business owner wants delegated control to managers, which is contrary to MAC's centralized, mandatory nature, so it is not appropriate.
- ✗
Attribute-based access control (ABAC)
Why it's wrong here
ABAC uses policies based on attributes and is typically more complex to implement and manage. It does not inherently allow individual managers to set permissions on specific folders; instead, policies are centrally defined. The small business owner wants a simple, delegated approach, which ABAC does not provide out of the box, so it is not the best fit.
- ✓
Discretionary access control (DAC)
Why this is correct
DAC allows resource owners to set permissions at their discretion, enabling department managers to control access to their folders without IT intervention. This matches the small business owner's requirement for delegated, flexible access control. DAC is simple to implement and commonly used in file systems, making it the most appropriate model here.
- ✗
Role-based access control (RBAC)
Why it's wrong here
RBAC assigns permissions to roles, and changes typically require administrative action to modify role assignments or permissions. While managers could be given roles that allow some control, RBAC does not natively allow resource owners to set permissions on specific folders. The requirement is for managers to decide access to their folders, which is more aligned with discretionary control, not role-based.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.