200-201 Question 58
Single answerA cybersecurity analyst is working in an organization that uses a mandatory access control (MAC) model to secure sensitive data and enforce rules. The analyst notices that a user is unable to access a file classified as 'Confidential,' even though the user has been assigned a 'Confidential' clearance level. Which of the following scenarios BEST explains why the access is being denied?
- A
The user does not have the appropriate role assigned to access the file.
- B
The file's classification level is higher than the user's assigned clearance level.
- C
The file has a need-to-know restriction that the user does not satisfy.
- D
The user is attempting to access the file outside of predefined working hours.
Show answer and explanation
Correct answer: C
Explanation
Mandatory access control (MAC), a type of nondiscretionary access control, strictly enforces rules based on sensitivity labels and classification levels. While the user has the required clearance level ('Confidential'), MAC also mandates that a user must satisfy the 'need-to-know' principle to access the data. Since the user lacks the need-to-know for the file, their access is denied. This demonstrates how MAC enforces stringent access controls beyond just clearance levels.
- A. Incorrect.
This explanation applies to discretionary access control (DAC) models, not mandatory access control (MAC). Nondiscretionary access control in MAC is determined by predefined policies, not roles.
- B. Incorrect.
This is incorrect because the problem states that the user has the same clearance level ('Confidential') required for the file, so this is not the issue.
- C. Correct.
This is correct because mandatory access control (a form of nondiscretionary access control) enforces both classification levels and need-to-know principles. Even if the classification level matches, access can still be denied if the user does not have a need-to-know for the file.
- D. Incorrect.
This is unrelated to access control models and does not apply to the scenario. Predefined working hours are not typically part of mandatory access control systems.