Drag a concept onto its matching description — or click a concept then click the description.
Concepts
Matches
Owner sets permissions
System-enforced labels
Roles determine access
Attributes and policies
mediumMatchingObjective-mapped
SSCP Practice Question: Match each access control model to its…
Match each access control model to its description.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Discretionary Access Control (DAC): Access decisions are based on the identity of the subject and the discretion of the object owner.
The four primary access control models are DAC (owner-determined), MAC (label-based), RBAC (role-based), and ABAC (attribute-based). Common confusions include mixing up DAC and MAC, or RBAC with DAC.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Discretionary Access Control (DAC): Access decisions are based on the identity of the subject and the discretion of the object owner.
Why this is correct
DAC allows the owner of an object to determine who can access it.
- ✓
Mandatory Access Control (MAC): Access is controlled by the system based on security labels and clearance levels.
Why this is correct
MAC uses a centralized policy to enforce access based on classifications.
- ✓
Role-Based Access Control (RBAC): Access is granted based on the roles assigned to users.
Why this is correct
RBAC simplifies management by assigning permissions to roles.
- ✓
Attribute-Based Access Control (ABAC): Access is determined by evaluating attributes of the user, resource, and environment.
Why this is correct
ABAC uses policies that combine multiple attributes for fine-grained control.
- ✗
Discretionary Access Control (DAC): Access is based on security labels and clearances.
Why it's wrong here
Incorrect — this describes MAC, where the system enforces access based on labels.
- ✗
Role-Based Access Control (RBAC): Access decisions are made by the data owner.
Why it's wrong here
Incorrect — this describes DAC, where the owner controls access.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
One of 920 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.