Cisco Cyber Security Practice Exam

What type of access control is based on the classification of information and the role of the user accessing it?

1. Discretionary access control

2. Role-based access control

3. Mandatory access control

4. Rule-based access control

The correct answer is: Role-based access control

Role-based access control (RBAC) is a security paradigm where access rights are granted based on the roles individuals hold within an organization. It operates on the principle that user permissions are linked to their responsibilities and functions, rather than being tied to individual identities. This method simplifies user management by allowing administrators to assign permissions to roles instead of each user individually, which is particularly beneficial in environments where employees frequently change roles or where there are numerous end-users. In RBAC, once a user is assigned to a specific role, they inherit the permissions correlated with that role. This approach not only enhances security by ensuring that users have the minimum necessary access—thus adhering to the principle of least privilege—but also streamlines the process of managing those permissions as organizational needs evolve. The other forms of access control mentioned focus on different methodologies: discretionary access control allows users to control access to their own resources; mandatory access control enforces access policies that cannot be altered by users; and rule-based access control utilizes predetermined rules to grant access rather than user roles or discretion.