A security architect is comparing mandatory access control with discretionary access control for a classified system. Which statement most accurately captures the essential difference between the two models?
- AUnder MAC each user is assigned a role and inherits its permissions, whereas under DAC each user is granted permissions individually by an owner
- BUnder MAC a central authority enforces access using labels that ordinary users cannot alter, whereas under DAC owners set permissions at their own discretion Correct
- CUnder MAC permissions are evaluated by system rules such as time of day, whereas under DAC permissions are fixed by the vendor at installation
- DUnder MAC owners may lower a file's classification to share it, whereas under DAC only administrators may change permissions
Why A is wrong: Tempting because it correctly describes DAC, but the MAC half wrongly describes role-based access control; MAC is defined by labels and clearance, not by roles.
Why B is correct: Correct: MAC binds access to system-enforced security labels beyond user control, while DAC delegates permission decisions to resource owners, which is the core distinction between the two.
Why C is wrong: Tempting because rules sound authoritative, but that describes rule-based control, and DAC permissions are set by owners after installation, not fixed by the vendor.
Why D is wrong: Tempting but reversed: MAC specifically prevents owners from altering labels, and DAC is precisely the model in which owners, not only administrators, change permissions.