200-201 Question 65
Single answerA cybersecurity analyst is tasked with implementing role-based access control (RBAC) in their organization. The analyst has identified the following roles: 'Manager,' 'Analyst,' and 'Intern.' Each role has different permissions for accessing the organization's incident response platform. Which of the following is the BEST example of adhering to RBAC principles?
- A
Granting all users full access to the incident response platform, regardless of their role.
- B
Configuring permissions such that only Managers can approve incident reports, Analysts can modify incident records, and Interns can view incident records but not make changes.
- C
Allowing each role to customize their own permissions based on their personal preferences.
- D
Providing all roles with the same access to incident records but restricting access to approval functionality for everyone.
Show answer and explanation
Correct answer: B
Explanation
Role-based access control (RBAC) assigns permissions based on the roles within an organization. The correct answer ensures that each role (e.g., Manager, Analyst, Intern) has appropriate access aligned with their responsibilities. This minimizes unnecessary access and adheres to the principle of least privilege, a fundamental concept in cybersecurity.
- A. Incorrect.
This violates RBAC principles because it does not differentiate access based on roles. Granting all users full access creates security risks and does not enforce the principle of least privilege.
- B. Correct.
This adheres to RBAC principles by assigning permissions based on roles and ensuring that each role has access only to the functions required for their responsibilities.
- C. Incorrect.
Allowing users to customize their own permissions undermines the RBAC model, which relies on predefined roles and permissions to ensure consistent and secure access control.
- D. Incorrect.
While restricting access to the approval functionality may enhance security, providing identical access to all roles does not align with the RBAC principle of assigning permissions based on job responsibilities.