Which access control model grants access based on a user's role?

Which access control model grants access based on a user's role?

• A. Discretionary access control (DAC)
• B. Mandatory access control (MAC)
• C. Attribute-based access control (ABAC)
• D. Role-based access control (RBAC)

Answer: (D)

Access decisions are based on what a person is allowed to do because of their role in the organization. In Role-Based Access Control, permissions are attached to roles, not to individual users. Users are given one or more roles, and when they try to access a resource, the system checks whether their role has the needed permission. This setup makes managing access scalable—if a user changes position, you adjust their role rather than editing many individual permissions, and you can enforce least privilege and separation of duties by assigning specific roles. Discretionary access control ties permissions to the resource owner, who can grant or revoke access to others. Mandatory access control uses a central policy and security labels to govern access. Attribute-based access control decides access based on multiple attributes of the user, resource, and environment rather than strictly on a role.

Access decisions are based on what a person is allowed to do because of their role in the organization. In Role-Based Access Control, permissions are attached to roles, not to individual users. Users are given one or more roles, and when they try to access a resource, the system checks whether their role has the needed permission. This setup makes managing access scalable—if a user changes position, you adjust their role rather than editing many individual permissions, and you can enforce least privilege and separation of duties by assigning specific roles.

Discretionary access control ties permissions to the resource owner, who can grant or revoke access to others. Mandatory access control uses a central policy and security labels to govern access. Attribute-based access control decides access based on multiple attributes of the user, resource, and environment rather than strictly on a role.