hardMultiple Choice
SSCP Practice Question: Is implementing an access control system where…
An organization is implementing an access control system where access decisions are based on the sensitivity of the resource and the clearance of the user. Which model is being used?
⚠ Common exam trap
A common mix-up: candidates confuse MAC with RBAC because both involve centralized control, but MAC uniquely relies on mandatory sensitivity labels and user clearances, not roles or user-defined permissions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Mandatory Access Control (MAC)
Mandatory Access Control (MAC) enforces access decisions based on comparing the sensitivity label (e.g., classification level) of the resource with the clearance level of the user. This model is non-discretionary, meaning users cannot override or delegate permissions; the system centrally controls all access according to a security policy, such as Bell-LaPadula or Biba.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Discretionary Access Control (DAC)
Why it's wrong here
DAC grants access by owner discretion, not by comparing resource sensitivity labels against user clearance levels. It is tempting because owners do control their own objects, but mandatory clearance-versus-classification matching is the defining mechanism of MAC, which is the model described.
- ✗
Attribute-Based Access Control (ABAC)
Why it's wrong here
ABAC evaluates multiple attributes and policies, whereas this scenario matches exactly two fixed values: resource sensitivity and user clearance. It is tempting because clearance and sensitivity are attributes, but the mandatory label comparison is MAC's mechanism, not ABAC's policy-based evaluation.
- ✗
Role-Based Access Control (RBAC)
Why it's wrong here
RBAC assigns permissions through roles, ignoring the resource's sensitivity label and the user's clearance level. It is tempting because roles simplify administration, but clearance-versus-classification matching is a mandatory label comparison, which is MAC, not role membership.
- ✓
Mandatory Access Control (MAC)
Why this is correct
MAC bases every access decision on comparing the resource's sensitivity label with the user's clearance, both assigned by the system rather than the owner. Users cannot alter these labels, which is the defining characteristic separating MAC from discretionary or role-based models.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 971-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SSCP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which access control model is best suited for a military environment where data classification (Unclassified, Confidential, Secret, Top Secret) and subject clearance levels are the primary factors for access decisions?
easy- A.Attribute-Based Access Control (ABAC)
- ✓ B.Mandatory Access Control (MAC)
- C.Discretionary Access Control (DAC)
- D.Role-Based Access Control (RBAC)
Why B: Mandatory Access Control (MAC) enforces access based on labels (classification and clearance) and is used in military and government settings. Option B is correct. Option A (ABAC) is attribute-based and not the traditional model for military-grade security. Option C (DAC) allows owners to set permissions, which is unsuitable for classified environments. Option D (RBAC) uses roles, not classification levels.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.