ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

The security group's behavior is governed entirely by predefined network rules (protocol, port, and source) that are centrally managed by administrators. Because instance owners cannot change these rules and access is decided strictly by the rule set, the model in use is rule-based access control-a form of nondiscretionary access control. Discretionary access control would allow resource owners to change permissions. Attribute-based access control would involve evaluating multiple dynamic attributes beyond simple fixed rules. Mandatory access control relies on security labels and classifications rather than per-rule firewall policies. Therefore, the scenario best represents rule-based access control.