easyMultiple ChoiceObjective-mapped
Discretionary Access Control (DAC): Owner Controls Access
In which access control model does the owner of a resource have full discretion over who can access it and with what permissions?
Quick Answer
The answer is Discretionary Access Control (DAC), because in this model the owner of a resource has full discretion over who can access it and with what permissions. The owner, typically the user who created the object, can grant or revoke access rights such as read, write, or execute to other subjects, often implemented through Access Control Lists (ACLs) on files or directories. On the Systems Security Certified Practitioner (SSCP) exam, this concept tests your understanding of how ownership-based permissions differ from rule-based or role-based models; a common trap is confusing DAC with Mandatory Access Control (MAC), where the system—not the owner—dictates access. Remember that DAC is the default in most operating systems like Windows NTFS or Linux, where the owner decides permissions via commands like `chmod` or GUI properties. A helpful memory tip: think of the word “discretion” as meaning “owner’s choice”—if the owner can decide, it’s DAC.
⚠ Common exam trap
Many candidates confuse DAC with RBAC because both involve user-based permissions, but the key distinction is that DAC gives the resource owner full discretion, whereas RBAC enforces access based on organizational roles, not individual owner decisions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Discretionary Access Control (DAC)
Discretionary Access Control (DAC) is the model where the resource owner has full authority to grant or deny access to other subjects and to set the permissions (e.g., read, write, execute) on the object. This is typically implemented through Access Control Lists (ACLs) on files or objects, as seen in Windows NTFS or Linux file permissions, where the owner can change permissions using commands like `chmod` or through GUI properties.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Attribute-Based Access Control (ABAC)
Why it's wrong here
ABAC uses policies based on subject/object attributes; owners do not have direct control.
- ✓
Discretionary Access Control (DAC)
Why this is correct
DAC allows data owners to grant or deny access based on their discretion, making it the correct model.
- ✗
Role-Based Access Control (RBAC)
Why it's wrong here
RBAC assigns permissions to roles, not to individuals; owners do not directly control access.
- ✗
Mandatory Access Control (MAC)
Why it's wrong here
MAC uses centrally defined security labels; users cannot change access permissions.
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 920-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SSCP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An organization wants to implement an access control model where data owners decide who can access resources. Which model should they choose?
medium- A.Attribute-Based Access Control (ABAC)
- B.Mandatory Access Control (MAC)
- C.Role-Based Access Control (RBAC)
- ✓ D.Discretionary Access Control (DAC)
Why D: Discretionary Access Control (DAC) is the correct model because it allows data owners (the users who create or own the resource) to decide who can access their resources. In DAC, the owner sets permissions (e.g., read, write, execute) on objects like files or directories, typically using Access Control Lists (ACLs). This directly matches the requirement where data owners control access decisions.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.