Which of the following access controls enforces permissions based on data labeling at specific levels?

MAC uses security labels such as Top Secret, Secret, and Unclassified assigned to data and users, and access is granted only when the subject's clearance level meets or exceeds the object's classification. This enforcement is system-controlled and cannot be overridden by data owners, making it suitable for environments requiring strict data compartmentalization. The question's phrase 'data labeling at specific levels' directly describes the MAC model.

Separation of duties is an administrative control that divides responsibilities among multiple people to prevent fraud, not a label-based access enforcement mechanism.

Discretionary Access Control (DAC) allows data owners to set permissions at their own discretion using ACLs, without enforcing classification labels.

Role-Based Access Control (RBAC) grants permissions based on a user's organizational role, not on data classification labels.