Match the Access Control Models in Column A with their features in Column B:…
2025
Match the Access Control Models in Column A with their features in Column B:
Column A - Access Control Models A. Zero Trust B. DAC (Discretionary AC) C. MAC (Mandatory AC) D. RBAC (Role-Based AC)
Column B - Features
Based on roles in an organization
Based on security labels/classification
Access decided by the data owner
Never trust, always verify (assume breach)
- A.
A-4, B-3, C-2, D-1
- B.
A-1, B-2, C-3, D-4
- C.
A-3, B-4, C-1, D-2
- D.
A-2, B-1, C-4, D-3
- E.
A-4, B-1, C-3, D-2
Attempted by 22 students.
Show answer & explanation
Correct answer: A
Concept
An access control model is the rule that decides WHO may use a resource and on WHAT basis. Four common models differ purely in the deciding factor: the data owner's discretion, a centrally assigned security label, the user's organizational role, or continuous verification regardless of network location.
Applying each definition
Zero Trust — assumes the perimeter is already breached, so it trusts nothing implicitly and verifies every request. This is the principle "never trust, always verify (assume breach)".
DAC (Discretionary Access Control) — the OWNER of the data has discretion to grant or revoke access. So access is "decided by the data owner".
MAC (Mandatory Access Control) — the system enforces access using fixed security labels/classifications (e.g. Confidential, Secret); users cannot override them. This is "based on security labels/classification".
RBAC (Role-Based Access Control) — permissions attach to a role (e.g. Manager, Clerk) and users inherit them through that role. This is "based on roles in an organization".
Resulting match
Zero Trust = "never trust, always verify", DAC = "decided by the data owner", MAC = "security labels/classification", RBAC = "roles in an organization".
Cross-check
The two often-confused models are DAC and MAC: DAC puts the decision in the owner's hands (flexible, discretionary), while MAC removes that discretion and binds access to system-assigned labels (rigid, mandatory). Keeping that contrast straight fixes the whole mapping.