ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question

The scenario describes a model in which the individual who owns a resource (the document creator) decides who else may access that resource and with what privileges. This is the defining characteristic of discretionary access control, where authority over objects is "at the discretion" of their owners. Role-based access control ties permissions to predefined organizational roles, not to individual owners. Mandatory access control relies on centrally enforced security labels that users cannot override. Attribute-based access control evaluates sets of subject, object, or environment attributes at decision time rather than relying on per-owner permissions. Therefore, discretionary access control is the correct choice.