In order to recognize the practical aspects of multilevel security in which, for example, an
unclassified paragraph in a Secret document has to be moved to an Unclassified document, the BellLaPadula model introduces the concept of a:

A.
Data flow

B.
Simple security property

C.
Trusted subject

D.
Secure exchange

Explanation:
The model permits a trusted subject to violate the *-property but to comply with the intent of the *-
property. Thus, a person who is a trusted subject could move unclassified data from a classified
document to an unclassified document without violating the intent of the *-property. Another
example would be for a trusted subject to downgrade the classification of material when it has been
determined that the downgrade would not harm national or organizational security and would not
violate the intent of the *-property. The simple security property (ss-property), answer “Simple
security property”, states that a subject cleared for one classification cannot read data from a higher
classification. This property is also known as the no read up property. Answers Secure exchange and
Data flow are distracters.