Two specific users need access to a directory owned by root where backups are located. Which of the following commands would BEST ensure the specified users can access the backup files?

umask controls the default permission bits subtracted when new files and directories are created and cannot grant access to an existing resource.

chcon modifies the SELinux security context label of a file, which affects mandatory access control policy, not traditional discretionary per-user file permissions.

chmod can only set permissions for the owner, a single group, and all others, so it cannot target two specific users without restructuring group assignments.

setfacl (set file access control list) allows an administrator to create discrete permission entries for specific named users on any file or directory, operating independently of the traditional owner/group/other permission model. A command such as 'setfacl -m u:username:rwx /backup' grants exactly the required access without modifying the directory's ownership or exposing it to other users. This is the only listed tool that natively targets individual users by name.