In the military, departments do not have the ability to alter access control rules set by higher authorities in ________.

• A. policy-based access control
• B. discretionary access control
• C. multilevel access control
• D. mandatory access control

Answer: (D)

Access decisions are governed by a centralized, non-discretionary policy. In mandatory access control, security labels on subjects (like a clearance level) and on objects (like a classified level) determine access, and the rules are defined by higher authorities and enforced by the system. Because the policy is fixed and cannot be overridden by departments or individual users, they cannot alter who can access what. This aligns with military needs for strict, uniform enforcement of access rights across the organization.

Discretionary access control would let data owners grant or revoke permissions, which would enable departments to change access locally. Policy-based access control uses policies to drive decisions, but the key distinction here is the centralized, non-discretionary enforcement that MAC embodies. Multilevel access control is a concept related to enforcing different levels of access, but the formal model described by the scenario is mandatory access control.