Exam CISSP Topic 2 Question 623 Discussion

Explanation/Reference:
Explanation:
A lattice is a mathematical construct that is built upon the notion of a group. The most common definition of the lattice model is "a structure consisting of a finite partially ordered set together with least upper and greatest lower bound operators on the set." Two methods are commonly used for applying mandatory access control:
Rule-based (or label-based) access control: This type of control further defines specific conditions for

access to a requested object. A Mandatory Access Control system implements a simple form of rule- based access control to determine whether access should be granted or denied by matching:
- An object's sensitivity label
- A subject's sensitivity label
Lattice-based access control: These can be used for complex access control decisions involving

multiple objects and/or subjects. A lattice model is a mathematical structure that defines greatest lower- bound and least upper-bound values for a pair of elements, such as a subject and an object.
Incorrect Answers:
B: The subject's upper bound must be equal or higher, not lower than the upper bound of the object being accessed.
C: The subject must have an upper bound.
D: The subject must have access rights determined by an upper bound.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, 2013, p. 381
https://en.wikipedia.org/wiki/Computer_access_control
http://en.wikipedia.org/wiki/Lattice-based_access_control