In which of the following access control models, owner of an object decides who is allowed to access the object and what privileges they have?

Question

Options

• AAccess Control List (ACL)
• BMandatory Access Control (MAC)
• CRole Based Access Control (RBAC)
• DDiscretionary Access Control (DAC)

• A
  3% (1)
• B
  8% (3)
• C
  14% (5)
• D
  76% (28)

Explanation

Discretionary Access Control (DAC) is correct because "discretionary" means the resource owner has full discretion to grant or revoke access to their objects - they decide who gets in and what permissions they have, making it the most flexible but least secure model.

Why the distractors are wrong:

• A (ACL) is a mechanism for implementing access control (a list of who can do what), not a model that defines who decides - ACLs can be used by DAC, MAC, or RBAC
• B (MAC) is the opposite of owner-controlled: a central authority (like the OS or security policy) enforces access based on labels/classifications, and owners cannot override it
• C (RBAC) grants access based on a user's assigned role (e.g., "Admin", "Manager"), not by the individual object owner's choice

Memory tip: Think Discretionary = Decided by the owner. The owner has discretion - just like a homeowner who decides who gets a key to their house.

No community discussion yet for this question.