Which access-control model assigns permissions based on roles?

Which access-control model assigns permissions based on roles?

• A. Discretionary Access Control (DAC)
• B. Mandatory Access Control (MAC)
• C. Role-Based Access Control (RBAC)
• D. Attribute-Based Access Control (ABAC)

Answer: (C)

Permissions based on roles means you grant access rights to a defined role and give users those rights by assigning them to that role. In this model, roles correspond to job functions, and each role has a specific set of permissions that allow actions on resources. When someone takes on a role, they inherit those permissions, and when they move to a different role, their access changes by updating their role membership. This makes administration easier and helps enforce the principle of least privilege, since you manage access at the role level rather than for each individual user. For example, a System Administrator role might include permissions to manage user accounts and modify system configurations, while a Finance Analyst role would have rights to view financial reports but not to alter system settings. If the person changes positions, you simply reassign their role, and their access adjusts accordingly. Discretionary Access Control centers on the data owner granting rights directly to other users, which can lead to inconsistent permission management. Mandatory Access Control relies on centralized security labels and clearances rather than roles. Attribute-Based Access Control makes decisions based on user, resource, and environmental attributes, offering more dynamic, fine-grained control. RBAC fits the scenario where permissions are tied to defined roles rather than individual users or broad attributes.

Permissions based on roles means you grant access rights to a defined role and give users those rights by assigning them to that role. In this model, roles correspond to job functions, and each role has a specific set of permissions that allow actions on resources. When someone takes on a role, they inherit those permissions, and when they move to a different role, their access changes by updating their role membership. This makes administration easier and helps enforce the principle of least privilege, since you manage access at the role level rather than for each individual user.

For example, a System Administrator role might include permissions to manage user accounts and modify system configurations, while a Finance Analyst role would have rights to view financial reports but not to alter system settings. If the person changes positions, you simply reassign their role, and their access adjusts accordingly.

Discretionary Access Control centers on the data owner granting rights directly to other users, which can lead to inconsistent permission management. Mandatory Access Control relies on centralized security labels and clearances rather than roles. Attribute-Based Access Control makes decisions based on user, resource, and environmental attributes, offering more dynamic, fine-grained control. RBAC fits the scenario where permissions are tied to defined roles rather than individual users or broad attributes.