hardMultiple Select
Mandatory Access Control: Key Characteristics
Which three statements are true regarding mandatory access control (MAC) systems? (Select THREE)
Quick Answer
Security labels are the defining mechanism of mandatory access control because MAC removes access decisions from the discretion of individual users or object owners entirely and places them under a system-enforced policy instead. Every subject, meaning a user or process, is assigned a clearance level, and every object, such as a file or document, is assigned a classification label; the system compares the two labels using a fixed rule set before granting or denying access, rather than consulting an owner's preference the way discretionary access control would. Multilevel security is the practical expression of this idea: data at different classification levels, such as Secret and Top Secret, is kept isolated, and movement of information between levels is tightly controlled by models like Bell-LaPadula, which enforces no read up and no write down to prevent lower-cleared subjects from seeing higher-classified data and higher-cleared subjects from leaking data downward. This label-driven, non-discretionary structure is what separates MAC from RBAC and DAC: RBAC ties permissions to job roles, and DAC lets owners set their own permissions, but only MAC forces every access decision through a comparison of formal security labels. Whenever a question describes classification levels, clearances, or a rule like Bell-LaPadula controlling who can read or write what, it's describing MAC's label-based model.
⚠ Common exam trap
Many exam-takers confuse MAC with Discretionary Access Control (DAC), where owners can change permissions and grant access, leading them to incorrectly select options D or E as true for MAC.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Multilevel security is enforced
Option A is correct because MAC systems enforce multilevel security, where information flows are restricted between hierarchical sensitivity levels (e.g., Confidential, Secret, Top Secret) according to the system's policy rather than user discretion. Option B is correct because in MAC, every subject (user or process) is assigned a clearance level that determines the maximum classification of data it may access. Option C is correct because access decisions in MAC are made by comparing the security labels (classification) of objects against the clearance and labels of subjects, per rules such as Bell-LaPadula's no-read-up and no-write-down. Option D is incorrect because in MAC the owner cannot arbitrarily relabel an object; label changes are controlled by the system's security policy and typically require privileged administrative authority. Option E is incorrect because discretionary delegation of permissions to other users is characteristic of DAC, not MAC, where access is governed by system-enforced labels and clearances rather than owner-granted permissions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Multilevel security is enforced
Why this is correct
MAC enforces multilevel security, where the system constrains information flow between sensitivity levels using labels and clearances. This mandatory, non-discretionary enforcement is the defining property distinguishing MAC from discretionary access control, where owners set permissions.
- ✓
Subjects have clearance levels
Why this is correct
In MAC, every subject holds a clearance level, and the system compares it against object labels before granting access. Clearances are assigned administratively, not by users, which is what makes access decisions mandatory rather than owner-controlled.
- ✓
Access decisions are based on security labels
Why this is correct
Security labels attached to subjects and objects drive every access decision, forming the core mechanism of mandatory access control. Clearance levels and object classifications are compared to grant or deny access, satisfying the stem's requirement for a label-based model that users cannot override or modify themselves.
- ✗
The owner of an object can change its security label
Why it's wrong here
MAC labels are assigned by the system's security administrator, not the object owner; owners cannot alter them, which is precisely what distinguishes MAC from DAC. It tempts because owner-controlled label changes are valid under discretionary access control, where the owner sets permissions on their own resources.
- ✗
Users can grant permissions to other users
Why it's wrong here
In MAC, authorisation derives from system-assigned labels and clearances, not user discretion, so users cannot delegate permissions. User-granted permissions describe discretionary access control; MAC would be the right model where a central policy, such as Bell-LaPadula, must enforce containment regardless of owner intent.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SSCP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO of the following are characteristics of a Mandatory Access Control (MAC) system?
medium- ✓ A.Access decisions are based on security labels.
- B.Access is determined by the owner of the object.
- C.It uses roles to assign permissions.
- D.Users can change permissions on their own objects.
- ✓ E.It is commonly used in military environments.
Why A: Option A is correct because a MAC system bases every access decision on security labels (sensitivity levels and categories) assigned to subjects and objects, rather than on user discretion; the system compares these labels against a policy to grant or deny access. Option E is correct because MAC is historically and commonly implemented in military and government environments, where strict confidentiality and need-to-know enforcement (e.g., via labels like Top Secret, Secret, Confidential) is required. Option B is incorrect because basing access on the object's owner describes Discretionary Access Control (DAC), where the owner decides who gets access. Option C is incorrect because using roles to assign permissions describes Role-Based Access Control (RBAC), not MAC. Option D is incorrect because allowing users to change permissions on their own objects is a hallmark of DAC, whereas in MAC users cannot alter the labels or permissions that govern access.
Variation 2. Which TWO of the following are characteristics of mandatory access control (MAC)?
medium- ✓ A.The system enforces access decisions based on policies
- ✓ B.Security labels are assigned to subjects and objects
- C.Access decisions are based on the user’s discretion
- D.It is commonly used in commercial environments
- E.Users can grant access to other users
Why A: Option A is correct because MAC is defined by policy-driven enforcement: the operating system or security kernel makes access decisions according to centrally administered rules (e.g., Bell-LaPadula or Biba models), not user choice. Option B is correct because MAC relies on security labels (sensitivity levels and categories) attached to both subjects and objects, and access is granted only when the subject's label dominates the object's label per the policy. Option C is incorrect because basing access on the user's discretion describes discretionary access control (DAC), where owners set permissions. Option D is incorrect because MAC is most commonly associated with high-assurance government, military, and intelligence environments rather than typical commercial settings. Option E is incorrect because in MAC users cannot delegate or grant access to others; only the policy administrator can change labels and authorizations.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.