ISC2 Certified in Cybersecurity (CC) Practice Question

Discretionary Access Control (DAC) puts control in the hands of the resource owner, allowing that person to decide who is allowed to access the resource and with what rights. In the scenario, the document creator (owner) directly grants or withholds privileges, matching DAC. Mandatory Access Control (MAC) relies on system-enforced labels and clearances, so individual users cannot override its rules. Role-Based Access Control (RBAC) assigns permissions to predefined organizational roles rather than to each specific user; users inherit access by assuming a role. Attribute-Based Access Control (ABAC) evaluates user, resource, and environmental attributes dynamically, not just owner decisions. Therefore, only DAC fits the described behavior.