At a bank, tellers cannot grant one another wire-transfer rights, and only a central policy tied to the job grants those rights. Which access-model family is in use?
Select an answer to reveal the explanation.
Short Explanation
Tellers do not hand each other the vault key; the job does. You are looking at nondiscretionary access decided by a central policy. The trap is calling it teller discretion, a firewall port rule, or a VPN certificate.
Full Explanation
The right selection is "Nondiscretionary access decided by a central policy that ties wire rights to the job". Nondiscretionary control is decided by the organization rather than by the person who holds the data. Tellers cannot grant the right to each other, and a central policy tied to the job is what grants it. The statement "Discretionary access, where any teller may grant wire-transfer rights to another teller" is the opposite family: the holder of the right would be free to give it away, and these tellers cannot. The statement "A firewall rule matching a network port, a packet control rather than a job-rights decision" filters packets by a port and does not decide which job may initiate a wire. The statement "A VPN certificate that proves device identity and does not itself grant wire-transfer rights" authenticates a device and is not the rule that grants or withholds the wire right. Exam caveat: the job is how the central policy is expressed, and the family name follows from the fact that coworkers cannot hand the right to each other. Operational check: review the wire-transfer entitlement and confirm it is assigned from the central job policy, with no teller-to-teller grant path.