Which access control model assigns permissions based on the user's role within an organization?

• A. Discretionary Access Control
• B. Role-Based Access Control
• C. Mandatory Access Control
• D. Attribute-Based Access Control

Answer: (B)

RBAC assigns permissions based on the user’s role within an organization. In this model, access rights are created for defined roles (such as “Employee,” “Manager,” or “Finance Analyst”), and individuals are granted those roles. The system then provides or restricts access according to the permissions attached to each role. This makes provisioning straightforward: when someone changes jobs, you adjust their role memberships rather than reconfiguring permissions for each resource. It also supports consistent enforcement of least privilege and helps with auditing and separation of duties, since roles can be designed to include only the necessary rights for a given function.

Discretionary access control relies on the resource owner to grant access, which can lead to inconsistent permissions and harder administration. Mandatory access control uses fixed security labels and classifications rather than job functions. Attribute-based access control makes decisions based on multiple attributes (of the user, resource, and environment) rather than roles. The scenario described—permissions tied to organizational roles—matches role-based access control best.