Which model uses administrator-managed ACLs to provide user permissions based on job functions?

Which model uses administrator-managed ACLs to provide user permissions based on job functions?

• A. Discretionary Access Control (DAC)
• B. Mandatory Access Control (MAC)
• C. Role-Based Access Control (RBAC)
• D. Attribute-Based Access Control (ABAC)

Answer: (C)

Mapping permissions to roles based on job functions is the essence of Role-Based Access Control. In this model, administrators define roles that align with what a particular job function needs, assign the appropriate permissions to those roles, and then grant users access by assigning them to the relevant roles. This centralizes control, makes it easier to enforce least privilege, and simplifies updates when someone moves to a different function—the user inherits the permissions of the new role rather than having permissions changed one by one. The administrator manages both the role-to-permission mappings and the user-to-role assignments, ensuring access reflects responsibilities. Discretionary Access Control lets owners grant access at their discretion, MAC enforces a system-wide mandatory policy using security labels, and ABAC makes decisions based on user, resource, and environment attributes.

Mapping permissions to roles based on job functions is the essence of Role-Based Access Control. In this model, administrators define roles that align with what a particular job function needs, assign the appropriate permissions to those roles, and then grant users access by assigning them to the relevant roles. This centralizes control, makes it easier to enforce least privilege, and simplifies updates when someone moves to a different function—the user inherits the permissions of the new role rather than having permissions changed one by one. The administrator manages both the role-to-permission mappings and the user-to-role assignments, ensuring access reflects responsibilities.

Discretionary Access Control lets owners grant access at their discretion, MAC enforces a system-wide mandatory policy using security labels, and ABAC makes decisions based on user, resource, and environment attributes.