Which SELinux Feature Meets Email Server Baseline Requirements?

Why the Answer Is Correct

SELinux is a Linux kernel security module implementing Mandatory Access Control (MAC) with policy rules covering all subjects and objects. Its Access Vector Cache (AVC) stores recently computed access decisions so the kernel avoids re-evaluating policy on every request, which directly matches the stated performance goal. SELinux documentation explicitly lists protection against unauthorized reading and modification of data and programs, bypassing application security mechanisms, privilege escalation, and interference with other processes — the exact four bullets in the question. Deploying SELinux in enforcing mode as part of a server system baseline therefore satisfies every stated requirement at once.

Why the Other Options Are Wrong

Privileged access management (B) governs administrative credential vaulting and session recording, but it provides no access vector cache and does not confine ordinary processes or block data-file tampering by compromised services. Self-encrypting disks (C) protect data at rest through hardware encryption and say nothing about MAC, process isolation, or application security bypass. A network intrusion prevention system (D) inspects traffic at the network layer; it cannot enforce in-kernel access decisions between local subjects and objects, so it addresses none of the four listed protections in the local baseline sense.

Community Comment Notes

A single comment from jamestkd argues for A, explaining that SELinux "explicitly utilizes an Access Vector Cache (AVC) to improve performance by caching access decisions" and covers the four listed protections. That reasoning matches the official SELinux architecture description, and no dissenting comment was posted, so the community position aligns with the technical analysis.