SSCP Access Controls Practice Question
Which TWO of the following are characteristics of the Biba integrity model? (Choose TWO.)
⚠ Common exam trap
SSCP often tests the mirror-image confusion between Biba (integrity: no write-up, no read-down) and Bell-LaPadula (confidentiality: no read-up, no write-down), so candidates who mix up the two models select the wrong pair.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
No write-up
Option A, 'No write-up,' is correct because the Biba integrity model's *-integrity axiom (the write-up rule) forbids a subject from writing to an object of higher integrity level, preventing low-integrity data from contaminating higher-integrity data. Option E, 'No read-down,' is correct because Biba's simple integrity axiom forbids a subject from reading an object of lower integrity level, preventing a high-integrity subject from being corrupted by low-integrity data. Option B, 'No write-down,' actually belongs to the Bell-LaPadula confidentiality model (the *-property), which restricts writing to lower or equal sensitivity levels, not to Biba. Option C, 'No read-up,' is also a Bell-LaPadula rule (the simple security property), prohibiting reading data at a higher classification, so it is not a Biba characteristic. Option D, 'Discretionary access,' describes discretionary access control (DAC) mechanisms such as owner-controlled ACLs, which are independent of the Biba mandatory integrity model and therefore not one of its defining characteristics.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
No write-up
Why this is correct
Subjects cannot write to higher integrity levels.
- ✗
No write-down
Why it's wrong here
This is not a Biba rule; Bell-LaPadula uses no write-down.
- ✗
No read-up
Why it's wrong here
This is Bell-LaPadula's simple security property.
- ✗
Discretionary access
Why it's wrong here
Biba is mandatory, not discretionary.
- ✓
No read-down
Why this is correct
Subjects cannot read from lower integrity levels.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
One of 971 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.