Designing a system in which only information that is essential for a particular job task is allowed to be viewed can be accomplished successfully by using:

The correct answer is C. role-based access control. Role-Based Access Control (RBAC) grants permissions based on a user's job role, ensuring each user only accesses the information essential for their specific function - directly implementing the principle of least privilege. If a user's role is Payroll Clerk, they see payroll…

Risk Management

Question

Options

Amandatory vacations.
Bjob rotations
Crole-based access control
Ddiscretionary access
Eseparation of duties

How the community answered

(53 responses)

A
2% (1)
B
4% (2)
C
89% (47)
D
6% (3)

Explanation

Role-Based Access Control (RBAC) grants permissions based on a user's job role, ensuring each user only accesses the information essential for their specific function - directly implementing the principle of least privilege. If a user's role is Payroll Clerk, they see payroll data but not HR disciplinary records, for example. Mandatory vacations (A) and job rotations (B) are personnel controls that detect fraud but don't restrict data access. Discretionary access (D) lets data owners set permissions freely, which doesn't enforce least-privilege by job function. Separation of duties (E) divides critical tasks among users but doesn't specifically restrict data visibility by role.

Topics

#RBAC#least privilege#need-to-know#access control

Community Discussion

No community discussion yet for this question.

Full CAS-003 Practice