Mandatory access control takes precedence over discretionary permissions is the correct option.

Mandatory access control enforces organization wide security policy by assigning labels to subjects and objects and by making access decisions based on those labels and policy rules. Discretionary controls allow owners to grant or restrict access but they operate within the constraints set by the mandatory access control policy so owner grants cannot override a mandatory access control denial. In a healthcare setting the mandatory access control rules typically implement classification and need to know requirements for patient records and those system enforced rules therefore take priority.

Both controls are evaluated independently with no automatic priority is incorrect because when mandatory access control and discretionary access control conflict the mandatory access control policy constrains what discretionary permissions can do. The system will enforce mandatory access control restrictions even if discretionary permissions would otherwise permit access.

Discretionary access control overrides mandatory restrictions is incorrect because resource owners cannot bypass centrally enforced policies. Discretionary permissions are subordinate to the mandatory access control rules and they cannot be used to negate those rules.

The resource owner chooses which control model applies for each object is incorrect because owners may set discretionary permissions but they cannot opt out of organization wide mandatory access control policies. The security architecture applies the system level policy rather than individual owner preference.

Full AWS Practitioner Certification Question