Question: ACLs and capability based security are two security models capable of what?

Is "This does not mean practical flaws exist in all ACL-based systems, but only that the designers of certain utilities must take responsibility to ensure that they do not introduce flaws.[citation needed]" the correct answer?
OPTIONS:
(a). yes
(b). no
(b).