In Discretionary Access Control the subject has authority, within certain limitations,

Question

Options

• Abut he is not permitted to specify what objects can be accessible and so we need to get an
• Bto specify what objects can be accessible.
• Cto specify on a aggregate basis without understanding what objects can be accessible.
• Dto specify in full detail what objects can be accessible.

• A
  2% (1)
• B
  90% (45)
• C
  2% (1)
• D
  6% (3)

Explanation

Discretionary Access Control (DAC) grants subjects (users or processes) the authority to decide which objects (files, resources) they can share or make accessible to others - this is the defining characteristic of DAC, making B correct. Option A contradicts the core definition by claiming the subject cannot specify accessible objects, which is the opposite of how DAC works. Option C is wrong because DAC operates at the individual object level, not on an "aggregate basis" - owners make per-object decisions. Option D is a subtle trap: while subjects do specify access, the phrase "in full detail" overstates it; subjects operate "within certain limitations" set by the system (e.g., they can't grant more permissions than they themselves hold).

Memory tip: Think of DAC as "Do As you Choose" - the data owner (subject) chooses who gets access, unlike Mandatory Access Control (MAC) where the system enforces policy regardless of the owner's wishes.

No community discussion yet for this question.