200-201 Question 52
Single answerAn organization wants to secure its database containing sensitive financial records. Only employees in the Finance department should have access to this data, and permissions should be based on their job roles. Which access control model is the most appropriate for this scenario?
- A
Discretionary Access Control (DAC)
- B
Mandatory Access Control (MAC)
- C
Role-Based Access Control (RBAC)
- D
Attribute-Based Access Control (ABAC)
Show answer and explanation
Correct answer: C
Explanation
Role-Based Access Control (RBAC) is the most appropriate model in this scenario because it aligns with the organization's requirement to grant access based on job roles. Employees in the Finance department can be assigned a role with the necessary permissions to access the database, simplifying management and ensuring compliance with access policies.
- A. Incorrect.
Discretionary Access Control (DAC) allows resource owners to determine access permissions, which is not suitable for enforcing department-wide or role-based access.
- B. Incorrect.
Mandatory Access Control (MAC) enforces strict access policies based on classification levels and is typically used in highly secure environments like government or military, not for role-based access within a corporate environment.
- C. Correct.
Role-Based Access Control (RBAC) assigns permissions based on the roles of users within the organization, making it ideal for granting access to the Finance department based on job roles.
- D. Incorrect.
Attribute-Based Access Control (ABAC) uses attributes such as user characteristics, resource types, or environmental conditions to determine access, which is more complex and not directly based on job roles in this scenario.