Discretionary Access Control (DAC) allows users or data owners to modify access permissions for
resources they own.
Owner-Based Permissions: The resource owner decides who can access or modify the resource.
Flexibility: Users can grant, revoke, or change permissions as needed.
Common Implementation: File systems where owners set permissions for files and directories.
Risk: Misconfigurations can lead to unauthorized access if not properly managed.
Other options analysis:
A . Mandatory Access Control (MAC): Permissions are enforced by the system, not the user.
B . Role-Based Access Control (RBAC): Access is based on roles, not user discretion.
D . Rule-Based Access Control: Permissions are determined by predefined rules, not user control.
CCOA Official Review Manual, 1st Edition Reference:
Chapter 7: Access Control Models: Clearly distinguishes DAC from other access control methods.
Chapter 9: Secure Access Management: Explains how DAC is implemented and managed.
