In order to recognize the practical aspects of multilevel security in
which, for example, an unclassified paragraph in a Secret document has
to be moved to an Unclassified document, the Bell-LaPadula model
introduces the concept of a:

A.
Data flow

B.
Simple security property

C.
Trusted subject

D.
Secure exchange

Explanation:
The model permits a trusted subject to violate the *-property but to
comply with the intent of the *-property. Thus, a person who is a
trusted subject could move unclassified data from a classified
document to an unclassified document without violating the intent
of the *-property. Another example would be for a trusted subject to
downgrade the classification of material when it has been
determined that the downgrade would not harm national or
organizational security and would not violate the intent of the
*-property. The simple security property (ss-property), answer “Simple security property”, states
that a subject cleared for one classification cannot read data from a
higher classification. This property is also known as the no read up
property. Answers Secure exchange and Data flow are distracters.