Mark works as a Network Administrator for NetTech Inc. He wants users to access only those resources that are required for them. Which of the following access control models will he use?

Question

Options

• APolicy Access Control
• BMandatory Access Control
• CDiscretionary Access Control
• DRole-Based Access Control

• A
  5% (1)
• B
  5% (1)
• C
  14% (3)
• D
  77% (17)

Explanation

Role-Based Access Control (RBAC) is the right fit because it assigns permissions based on a user's job role - exactly what Mark needs when restricting access to only the resources relevant to each user's function within the organization. Policy Access Control (A) is not a standard access control model; it's a distractor term. Mandatory Access Control (B) is used in high-security environments where the system enforces access based on classification labels (e.g., Top Secret), not job roles - it's too rigid and centralized for a typical corporate scenario. Discretionary Access Control (C) lets resource owners decide who gets access, meaning individual users can grant others permissions - this gives too much freedom and doesn't align with enforcing least-privilege by role.

Memory tip: Think "Role = Job" - RBAC matches access to what your job title requires, like a nurse seeing patient records but not billing data. If the scenario mentions "users should only access what they need for their job," RBAC is almost always the answer.

No community discussion yet for this question.