ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Discretionary Access Control (DAC) makes the object creator (or owner) responsible for setting and changing permissions on that object. Because owners can delegate access at their own discretion, DAC fits the requirement that scientists control permissions on files they create. Mandatory Access Control would place control in centrally-managed security labels, preventing owners from changing access. Role-Based Access Control would tie access to predefined roles or groups, not individual ownership decisions. Attribute-Based Access Control relies on evaluating multiple subject and object attributes, rather than simple owner-controlled ACLs, and still would not automatically give each creator control. Therefore, DAC is the appropriate model while allowing the security team to audit changes separately.