200-201 Question 53
Single answerA system administrator at a company is responsible for granting access to sensitive files. They decide to allow specific users to access a file based on their own judgment, without consulting predefined roles or policies. What type of access control is being implemented in this scenario?
- A
Discretionary Access Control (DAC)
- B
Mandatory Access Control (MAC)
- C
Role-Based Access Control (RBAC)
- D
Attribute-Based Access Control (ABAC)
Show answer and explanation
Correct answer: A
Explanation
The scenario describes a case where the system administrator decides access controls based on their discretion, which is characteristic of Discretionary Access Control (DAC). Unlike other models like MAC, RBAC, or ABAC, DAC allows resource owners or administrators to make such decisions without relying on predefined roles, policies, or attributes.
- A. Correct.
Discretionary Access Control (DAC) allows the owner or administrator of the resource to determine who is allowed access, based on their discretion. This matches the scenario described where the administrator decides who gets access.
- B. Incorrect.
Mandatory Access Control (MAC) enforces policies that are defined by the system, not individuals. It typically involves predefined classifications or levels of access, which does not align with the scenario.
- C. Incorrect.
Role-Based Access Control (RBAC) assigns permissions based on predefined roles within the organization. Since the decision in the scenario is based on the administrator's discretion rather than a role, this is not correct.
- D. Incorrect.
Attribute-Based Access Control (ABAC) uses attributes (such as user characteristics or environmental factors) to determine access. The scenario does not mention attributes being used, so this is incorrect.