Which of the following access control methodologies can be described BEST as allowing a user the least access based on the jobs the user needs to perform?

Role-based Access Control (RBAC) is the methodology that directly aligns with granting permissions based on a user's job function. In an RBAC model, access rights and permissions are assigned to specific roles (e.g., "Accountant," "System Administrator," "Sales Representative"). Users are then assigned to these roles. This ensures that each user only has the access necessary to perform the tasks associated with their specific job, thereby enforcing the principle of least privilege. This model simplifies administration by managing roles instead of individual user permissions.

A. Scope-based: This is not a standard, formally recognized access control methodology within information security frameworks like those covered by CompTIA.
C. Location-based: This model restricts access based on the user's physical or network location (e.g., IP address), not their job responsibilities.
D. Rule-based: This model grants access based on a set of configured rules, such as time of day or connection type, which apply broadly and are not inherently tied to an individual's job function. ---

1. National Institute of Standards and Technology (NIST) Special Publication 800-53

Revision 5

Security and Privacy Controls for Information Systems and Organizations. (December 2020). In Appendix F

Security Control Catalog

under control AC-2 (Account Management)

the discussion of Role-Based Access Control (RBAC) states

"Organizations may define access privileges for roles

and then assign individuals to the roles." This directly links access to job roles.

2. Ferraiolo

D. F.

& Kuhn

D. R. (1992). Role-Based Access Control. 15th National Computer Security Conference. In Section 2

"The Role-Based Access Control Model

" the paper defines the model as one where "permissions are associated with roles

and users are assigned to appropriate roles

" simplifying the alignment of permissions with organizational functions.

3. Sandhu

R. S.

Coyne

E. J.

Feinstein

H. L.

& Youman

C. E. (1996). Role-Based Access Control Models. IEEE Computer

29(2)

38-47. https://doi.org/10.1109/2.485845. The article's abstract and introduction (p. 38) establish RBAC as a method to "assign users to roles based on their specific job responsibilities and skills."