A new startup company is growing and wants to deploy a human resources management system on a private cloud that is only accessible to the human resources department. Which of the following is the…

In DAC, the owner of a resource - in this case the HR department - has direct authority to grant or revoke access permissions for other users without requiring a central authority. Because the HR management system is exclusively for the HR department's use, placing access control decisions in the hands of the data owners is both practical and appropriate. DAC is the standard model in most enterprise and cloud environments where departmental resource owners manage their own data independently.

Mandatory Access Control (MAC) enforces access based on centrally assigned security labels and clearance levels, making it appropriate for military or classified environments rather than a commercial HR system.

Non-discretionary access control such as RBAC is centrally administered by IT staff based on predefined roles rather than by the resource owner, removing direct control from the HR department itself.

'Comprehensive access control' is not a recognized access control model in any standard security framework such as NIST or ISO 27001.