In a refinement of the BellÖLaPadula model, the strong tranquility
property states that:

A.
Objects never change their security level.

B.
Objects can change their security level in an unconstrained fashion.

C.
Objects never change their security level in a way that would violate the system security policy.

D.
Subjects can read up.

Explanation:
Answer “Objects never change their security level in a way that would violate the system security
policy” is known as the weak tranquility property. The two other answers are distracters.