DAC - Discretionary Access Control is where the user controls access to the data they create or manage.
It is the least secure method of access control because of a few factors:
- Employee changeover can lead to confusion of data ownership or abandoned data.
- Employees are not traditionally experienced enough to manage data permissions and maintain them in a reliable fashion.
- People in general are the least reliable component of any organization
The following answers are incorrect:
- MAC - Mandatory Access Control: This is incorrect because in the MAC model of access control, labels are used to identify the level of sensitivity of the data. If the user does not have privileges to such data he or she is denied access.
- RBAC - Role-Based Access Control: Sorry, RBAC is Role-Based Access Control where the users' Role determines the access level to data they are given.
- NDAC - Non-Discretionary Access Control: Sorry, this isn't a common term associated with access control methodologies.
The following reference(s) was used to create this question:
2013 Official Security+ Curriculum.

War dialing, or scanning, has been a common activity in the computer underground and computer security industry for decades. Hollywood made war dialing popular with the 1983 movie, War Games, in which a teenager searching for a videogame company ultimately uncovers a government nuclear war warning system. The act of war dialing is extremely simple - a host computer dials a given range of telephone numbers using a modem. Every telephone number that answers with a modem and successfully connects to the host is stored in a log. Disabling call forwarding is not a useful countermeasure because it's the attacker machine the one who connects to the attacked system and forwarding is not an issue inside the attack. Answer A, C and D can be used as countermeasures to harder the war dial attack.

The correct answer is "Logical controls". The other answers are different categories of controls where preventive controls attempt to eliminate or reduce vulnerabilities before an attack occurs; detective controls attempt to
determine that an attack is taking place or has taken place; and corrective controls involve taking action to restore the system to normal operation after a successful attack.