In which model are access rules centrally controlled and cannot be altered by resource owners?

• A. Policy-based access control
• B. Discretionary access control
• C. Mandatory access control
• D. Multilevel access control

Answer: (C)

Access decisions are governed by a centralized set of rules that apply uniformly and cannot be changed by individual resource owners. In this model, a central authority defines security labels and a policy that determines who can access what, and the system enforces those rules regardless of the desires of the resource owner. This ensures consistent protection and prevents owners from granting special rights or bypassing protections.

That’s why this model is the correct choice: it embodies strict, top-down control where access rights are dictated by the policy and labels, not by those who own the resources. In contrast, discretionary access control lets owners grant or revoke permissions themselves, so it doesn’t meet the “cannot be altered by resource owners” criterion. Multilevel access control is a form of this centralized approach, typically incorporating levels of clearance, but the fundamental idea remains centralized enforcement rather than owner-driven decisions.