(ISC)2 Certified in Cybersecurity Practice Exam

What feature is common in role-based access control?

1. Access is restricted based on physical location

2. Access is determined by user roles within the organization

3. Access is granted based on individual discretion

4. Access is completely open to all users

The correct answer is: Access is determined by user roles within the organization

In role-based access control (RBAC), the primary feature is that access is determined by the specific roles assigned to users within an organization. This model aligns permissions with roles that users assume, meaning that individuals receive access rights based on their responsibilities and relationships to the organization’s data and systems. For instance, a user assigned to a managerial role may have access to sensitive financial information, while a staff member in a different role may only have access to basic operational documents. This structure not only helps to streamline access management but also enhances security by ensuring that users have the minimum access necessary to perform their functions. The system relies on predefined roles, making it easier to manage user permissions systematically. Each role encompasses a set of permissions, which can then be assigned to users as needed. As users change roles or responsibilities, their access can be effortlessly adjusted in accordance with the established role definitions, promoting effective access control while minimizing the risks associated with unauthorized or excess access rights.