Which statement accurately describes DAC, MAC, and RBAC?

• A. DAC: owner-controlled permissions; MAC: policy-based labels (e.g., SELinux); RBAC: role-based access assignments
• B. DAC: owner-controlled permissions; MAC: password policies; RBAC: time-based access assignments
• C. DAC: mandatory access control; MAC: owner-controlled; RBAC: none
• D. DAC: owner-controlled permissions; MAC: password policies; RBAC: role-based restrictions

Answer: (B)

Access control models describe who can access resources and how those decisions are made. Discretionary Access Control means the owner of an object controls its permissions and can grant or revoke access to others at their discretion. The owner’s choices determine who gets what rights. Mandatory Access Control, on the other hand, relies on a centralized policy that uses labels or classifications to enforce access decisions regardless of the owner's wishes—policy dictates who may access what. This is often implemented with labeled subjects and objects and a policy engine (for example, SELinux). Role-Based Access Control assigns permissions to roles rather than to individual users; users obtain access by being assigned to appropriate roles, which streamlines management and supports consistent enforcement of the principle of least privilege.

So the statement that best reflects these concepts is that Discretionary Access Control is owner-controlled permissions; Mandatory Access Control uses policy-based labels enforced by a central policy; and Role-Based Access Control uses role-based access assignments. The other descriptions mix in irrelevant ideas like password policies or time-based restrictions, or incorrectly pair DAC with mandatory control, which don’t fit the standard definitions.