Which statement about discretionary access control (DAC) versus mandatory access control (MAC) is accurate?

• A. MAC uses centralized labels and policies to enforce access decisions.
• B. ABAC uses attributes to define access.
• C. RBAC uses roles to assign permissions.
• D. DAC lets owners grant access and is discretionary.

Answer: (D)

In discretionary access control, the owner of an object decides who can access it and can grant or revoke permissions at their discretion. This means access is governed by the owner's choices rather than a fixed system policy. Mandatory access control, by contrast, uses centralized, system-enforced labels and policies to determine access, independent of individual owners. Because it captures the essence of DAC—the owner’s discretionary control over permissions—the statement that DAC lets owners grant access and is discretionary is the accurate one. The other descriptions point to different access-control models (MAC’s policy-driven enforcement, ABAC’s attribute-based rules, and RBAC’s role-based permissions) rather than the DAC vs MAC distinction.