Network Defense Essentials (NDE) 2025 – 400 Free Practice Questions to Pass the Exam

Discretionary access control (DAC) is the correct answer because this model grants resource owners the authority to determine who can access their resources and what kind of permissions they can have. In a DAC system, the owner of the data or resources sets the policies for who can view or interact with that data, allowing for a flexible and user-controlled environment. This means that ownership inherently comes with the ability to assign access to others, which is a fundamental characteristic of DAC.

In contrast, the mandatory access control (MAC) model does not allow resource owners to make access decisions; instead, access decisions are made based on predefined policies set by a central authority, and users cannot alter these permissions. Role-Based Access Control (RBAC) assigns access based on user roles and does not inherently allow individual resource owners the discretion to decide who can access their resources. Additionally, Rule-Based Access Control refers to a model where access is governed by a set of rules or policies that dictate permissions, similarly limiting the individual owner's discretion.