200-201 Question 51
Single answerA cybersecurity analyst is tasked with implementing an access control model for a financial organization's internal systems. The organization requires that access to data is determined based on job roles and responsibilities, ensuring that employees only have access to the information they need to perform their duties. Which access control model best fits this requirement?
- A
Discretionary Access Control (DAC)
- B
Role-Based Access Control (RBAC)
- C
Mandatory Access Control (MAC)
- D
Attribute-Based Access Control (ABAC)
Show answer and explanation
Correct answer: B
Explanation
Role-Based Access Control (RBAC) is the most appropriate model for this scenario as it provides access permissions based on job roles and responsibilities, meeting the organization's need to limit access to only what is necessary for employees to perform their duties. Other models like DAC, MAC, or ABAC do not align as closely with the role-based requirement described in the scenario.
- A. Incorrect.
Discretionary Access Control (DAC) allows the owner of the data to determine access permissions. This is not suitable for the scenario, as it does not align with the organization's requirement to base access on roles and responsibilities.
- B. Correct.
Role-Based Access Control (RBAC) is the correct model for this scenario, as it assigns access permissions based on job roles and responsibilities, ensuring employees only access the information they need to perform their duties.
- C. Incorrect.
Mandatory Access Control (MAC) enforces access based on classifications and clearance levels, typically in highly secure environments like military or government settings. This does not align with the organization's focus on job roles.
- D. Incorrect.
Attribute-Based Access Control (ABAC) uses attributes (e.g., user, resource, environment) to determine access, providing fine-grained control. While powerful, it is more complex and not explicitly focused on roles, making it less suitable than RBAC for this scenario.