200-201 Question 57
Single answerA cybersecurity analyst is tasked with configuring access control for a secure database containing sensitive customer information. The organization has mandated that access should be based strictly on the employee's role within the company, with no option for individual users to modify permissions themselves. Which access control model should the analyst implement?
- A
Discretionary Access Control (DAC)
- B
Role-Based Access Control (RBAC)
- C
Mandatory Access Control (MAC)
- D
Attribute-Based Access Control (ABAC)
Show answer and explanation
Correct answer: B
Explanation
Role-Based Access Control (RBAC) is a nondiscretionary access control model where access permissions are assigned to roles rather than individual users. This ensures that users cannot independently modify permissions and aligns with the organization's requirement for strict role-based access management.
- A. Incorrect.
Discretionary Access Control (DAC) allows data owners to control access permissions. This does not align with the requirement where users cannot modify permissions themselves.
- B. Correct.
Role-Based Access Control (RBAC) restricts access based on roles within an organization. It is a nondiscretionary model where permissions are tied to roles, not individual users, making it the correct choice in this scenario.
- C. Incorrect.
Mandatory Access Control (MAC) enforces strict access policies determined by a central authority, but it typically applies to environments with government-grade security requirements. While it is nondiscretionary, it is not specifically role-based.
- D. Incorrect.
Attribute-Based Access Control (ABAC) grants access based on attributes such as time, location, or device. While it is flexible, it is not specifically mentioned as being role-based, which is the key requirement in this scenario.