Which security concept ensures users access only data and actions required for their role?

Which security concept ensures users access only data and actions required for their role?

• A. Mandatory access control.
• B. Least privilege access control and role-based permissions.
• C. Discretionary access control.
• D. Two-factor authentication.

Answer: (B)

The principle of least privilege with role-based access control is about giving users only the minimum permissions and data they need to perform their job. By defining roles and assigning permissions to those roles, and then assigning users to the appropriate roles, an organization restricts access to what each person truly requires. This reduces the risk of accidental or intentional data exposure and makes enforcement and auditing clearer and more scalable. For example, a payroll clerk would have access limited to payroll-related data and actions, not to unrelated systems or records, while system engineers would have access scoped to maintenance tasks, all aligned with their role. Two-factor authentication focuses on verifying identity, not on what data or actions a user is allowed to access, so it doesn’t by itself limit data access. Discretionary access control lets data owners grant access, which can lead to inconsistent and broader access. Mandatory access control uses fixed, label-based policies that can be too rigid to reflect actual job duties. As a result, least privilege with role-based permissions best addresses restricting access to what’s necessary for the role.

The principle of least privilege with role-based access control is about giving users only the minimum permissions and data they need to perform their job. By defining roles and assigning permissions to those roles, and then assigning users to the appropriate roles, an organization restricts access to what each person truly requires. This reduces the risk of accidental or intentional data exposure and makes enforcement and auditing clearer and more scalable. For example, a payroll clerk would have access limited to payroll-related data and actions, not to unrelated systems or records, while system engineers would have access scoped to maintenance tasks, all aligned with their role.

Two-factor authentication focuses on verifying identity, not on what data or actions a user is allowed to access, so it doesn’t by itself limit data access. Discretionary access control lets data owners grant access, which can lead to inconsistent and broader access. Mandatory access control uses fixed, label-based policies that can be too rigid to reflect actual job duties. As a result, least privilege with role-based permissions best addresses restricting access to what’s necessary for the role.