Access control is the collection of mechanisms that permits managers of a system to exercise a directing or
restraining influence over the behavior, use, and content of a system. It does not permit management to:

A.
specify what users can do.

B.
specify which resources they can access.

C.
specify how to restrain hackers.

D.
specify what operations they can perform on a system.

Explanation:
Access controls are security features that control how users and systems communicate and interact with other
systems and resources. Access controls give organization the ability to control, restrict, monitor, and protect
resource availability, integrity and confidentiality.
Access controls do not enable management to specify how to restrain hackers. Access controls can only
prevent hackers accessing a system.
Incorrect Answers:
A: Access control does enable managers of a system to specify what users can do within the system.
B: Access control does enable managers of a system to specify which resources they can access.
D: Access control does enable managers of a system to specify what operations they can perform on a system.

https://en.wikibooks.org/wiki/Fundamentals_of_Information_Systems_Security/Access_Control_Systems