What is access decisions based on in a MAC (Mandatory Access Control) environment?

What is access decisions based on in a MAC (Mandatory Access Control) environment?

A.
Access control lists

B.
Ownership

C.
Group membership

D.
Sensitivity labels

Explanation:
Reference: Security + (SYBEX) page