What access control model assigns permissions based on an employee's role within the organization?

What access control model assigns permissions based on an employee's role within the organization?

• A. RBAC
• B. DAC
• C. MAC
• D. ABAC

Answer: (A)

Role-based access control assigns permissions based on a person’s role in the organization. In this model, users are given one or more roles, and each role has a defined set of permissions. When a user attempts to access a resource, the system grants access according to the permissions of that user’s role, not individual permissions you’ve assigned to the user. This makes managing access scalable and aligned with job functions: you adjust a user’s access by changing their role rather than editing permissions for many individuals. It also supports least privilege and helps with separation of duties by designing roles that reflect actual responsibilities. Other models operate differently: discretionary access control ties permissions to the resource owner, mandatory access control uses centralized labels and strict policies, and attribute-based access control makes decisions based on attributes of the user, resource, and environment rather than fixed roles.

Role-based access control assigns permissions based on a person’s role in the organization. In this model, users are given one or more roles, and each role has a defined set of permissions. When a user attempts to access a resource, the system grants access according to the permissions of that user’s role, not individual permissions you’ve assigned to the user. This makes managing access scalable and aligned with job functions: you adjust a user’s access by changing their role rather than editing permissions for many individuals. It also supports least privilege and helps with separation of duties by designing roles that reflect actual responsibilities. Other models operate differently: discretionary access control ties permissions to the resource owner, mandatory access control uses centralized labels and strict policies, and attribute-based access control makes decisions based on attributes of the user, resource, and environment rather than fixed roles.