At an agency, the owner of a project folder adds a coworker to the folder, and no central office changes a sensitivity label. Which access model allows that owner decision?
Select an answer to reveal the explanation.
Short Explanation
Handing your own key to a coworker is not the same as a guard who ignores you. You are seeing discretionary access control by the folder owner. The trap is calling it a mandatory label, a time window, or an attribute rule that skips the owner.
Full Explanation
The right selection is "Discretionary access control, the owner adding a coworker with no central label change". Discretionary control leaves the grant decision with the owner of the resource. The owner added the coworker, and no central office changed a label, so the decision was the owner's. The statement "Mandatory access control that applies a sensitivity label the folder owner cannot override" would stop the owner from overriding a label, and nothing in this change is a label the owner was forbidden to touch. The statement "Time-based access that opens the folder only inside a schedule and ignores who the owner adds" would allow or deny by the clock, and the scenario is about who was added, not when the folder opens. The statement "An attribute policy that ignores the owner and grants access from other attributes alone" would decide from attributes other than the owner's choice, and here the owner's choice is exactly what happened. Exam caveat: a higher mandatory policy can still block an owner grant when labels exist; this case has no label change and the owner grant succeeded. Operational check: review the folder permissions and confirm the owner added the coworker without a label workflow.