Which of the following access control models is based on sensitivity labels?

A.
Discretionary access control

B.
Mandatory access control

C.
Rule-based access control

D.
Role-based access control

Explanation:
Mandatory Access control is considered nondiscretionary and is based on a security label system
Incorrect Answers:
A: Discretionary Access Control (DAC) allows data owners to dictate what subjects have access to the files and
resources they own.
C: Rule-based access control is considered nondiscretionary because the users cannot make access decisions
based upon their own discretion.
D: Role-based access control (RBAC) provides access to resources according to the role the user holds within
the company or the tasks that the user has been assigned.

Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, 2013, pp. 220-228