A company hired Joe, an accountant. The IT administrator will need to create a new account for Joe. The company uses groups for ease of management and administration of user accounts. Joe will need…

Assigning a user to an 'accounting group' is a form of group-based access control but does not specifically implement the structured, role-defined permissions that RBAC provides for meeting comprehensive departmental access requirements.

RBAC ties access rights to a defined job role (accounting) rather than to an individual account or manually selected resources. When Joe is assigned the accounting role, he automatically inherits all permissions defined for that role - access to accounting directories, folders, and files - aligning with the company's group-based management approach and the principle of least privilege.

Creating an account with a password reset notification addresses account setup logistics but says nothing about assigning the required access permissions to accounting resources.

Creating a second account with full network administration rights violates least privilege by granting far more access than an accountant requires.