A system administrator needs to ensure that certain departments have more restrictive controls to their shared folders than other departments. Which of the following security controls would be…

User-assigned privileges require configuring each individual account separately, which is not scalable and does not efficiently enforce department-wide restrictions.

Password disablement locks accounts and removes access entirely rather than restricting folder permissions to specific departments.

Creating multiple accounts does not address access control restrictions and introduces identity management complexity.

Group-based access control assigns permissions to security groups rather than individual accounts, so all users in a department group inherit the same restrictive or permissive controls on shared folders. This is the standard and scalable method for enforcing department-level access policies in directory environments such as Active Directory.