A technician wants to implement a dual factor authentication system that will enable the
organization to authorize access to sensitive systems on a need-to-know basis. Which of the
following should be implemented during the authorization stage?

A.
Biometrics

B.
Mandatory access control

C.
Single sign-on

D.
Role-based access control

Explanation:
This question is asking about “authorization”, not authentication.
Mandatory access control (MAC) is a form of access control commonly employed by government
and military environments. MAC specifies that access is granted based on a set of rules rather
than at the discretion of a user. The rules that govern MAC are hierarchical in nature and are often
called sensitivity labels, security domains, or classifications.

MAC can also be deployed in private sector or corporate business environments. Such cases
typically involve the following four security domain levels (in order from least sensitive to most
sensitive):
Public
Sensitive
Private
Confidential
A MAC environment works by assigning subjects a clearance level and assigning objects a
sensitivity label—in other words, everything is assigned a classification marker. Subjects or users
are assigned clearance levels. The name of the clearance level is the same as the name of the
sensitivity label assigned to objects or resources. A person (or other subject, such as a program or
a computer system) must have the same or greater assigned clearance level as the resources
they wish to access. In this manner, access is granted or restricted based on the rules of
classification (that is, sensitivity labels and clearance levels).
MAC is named as it is because the access control it imposes on an environment is mandatory. Its
assigned classifications and the resulting granting and restriction of access can’t be altered by
users. Instead, the rules that define the environment and judge the assignment of sensitivity labels
and clearance levels control authorization.
MAC isn’t a very granularly controlled security environment. An improvement to MAC includes the
use of need to know: a security restriction where some objects (resources or data) are restricted
unless the subject has a need to know them. The objects that require a specific need to know are
assigned a sensitivity label, but they’re compartmentalized from the rest of the objects with the
same sensitivity label (in the same security domain). The need to know is a rule in and of itself,
which states that access is granted only to users who have been assigned work tasks that require
access to the cordoned-off object. Even if users have the proper level of clearance, without need
to know, they’re denied access. Need to know is the MAC equivalent of the principle of least
privilege from DAC