ISC2-CC - Access Controls Concepts (22% of the exam) - Section 3.2

Understand logical access control models, including discretionary (DAC), mandatory (MAC), role-based (RBAC), and rule-based access control.

Distinguish the access control models: discretionary access control (DAC), where the data owner grants access; mandatory access control (MAC), where access is enforced by labels and clearances; role-based access control (RBAC), where permissions attach to job roles; and rule-based control, which applies conditions such as time or location. Match each model to the scenario it best fits.

Discretionary access controlMandatory access controlRole-based access controlRule-based access control

Practice question for this objective

Free sampleAccess Controls Conceptshard

A security architect is comparing mandatory access control with discretionary access control for a classified system. Which statement most accurately captures the essential difference between the two models?

AUnder MAC each user is assigned a role and inherits its permissions, whereas under DAC each user is granted permissions individually by an owner
BUnder MAC a central authority enforces access using labels that ordinary users cannot alter, whereas under DAC owners set permissions at their own discretion Correct
CUnder MAC permissions are evaluated by system rules such as time of day, whereas under DAC permissions are fixed by the vendor at installation
DUnder MAC owners may lower a file's classification to share it, whereas under DAC only administrators may change permissions

Distinguish mandatory access control from discretionary access control by who controls permissions and whether labels are user-alterable. MAC enforces access through non-discretionary security labels and clearances that users cannot override, whereas DAC places permission decisions in the hands of resource owners.

Why A is wrong: Tempting because it correctly describes DAC, but the MAC half wrongly describes role-based access control; MAC is defined by labels and clearance, not by roles.

Why B is correct: Correct: MAC binds access to system-enforced security labels beyond user control, while DAC delegates permission decisions to resource owners, which is the core distinction between the two.

Why C is wrong: Tempting because rules sound authoritative, but that describes rule-based control, and DAC permissions are set by owners after installation, not fixed by the vendor.

Why D is wrong: Tempting but reversed: MAC specifically prevents owners from altering labels, and DAC is precisely the model in which owners, not only administrators, change permissions.

See more ISC2-CC practice questions, answers explained.

Exam traps in Access Controls Concepts

Answers that look right on this material and are not. Each one is a distractor from a different question in the ISC2-CC bank for this domain.

Discretionary access control, so that each document creator assigns clearances to the analysts they trust
Why it is wrong: DAC is tempting because creators do control their own files, but leaving classification decisions to individual owners is exactly the discretion the security team wants to remove.
Discretionary access control, because each customer decides which regions and hours their own account will accept
Why it is wrong: DAC is tempting because it is account-centric, but the credit union wants a uniform policy, not per-customer discretion over regions and hours.
Rule-based control lets each resource owner set permissions personally, while role-based control removes owner discretion entirely.
Why it is wrong: Owner-set permissions describe DAC, not rule-based control. It is tempting because both start with the same letters, but neither clause here correctly separates rule-based from role-based control.

Examworthy is not affiliated with or endorsed by ISC2. Original, blueprint-aligned practice material only.