Which term describes restricting access to only what is necessary for a user's role?

Which term describes restricting access to only what is necessary for a user's role?

• A. Mandatory access control.
• B. Discretionary access control.
• C. Least privilege access control and role-based permissions.
• D. Zero trust access.

Answer: (C)

Restricting access to only what is necessary for a user's role relies on granting the minimum rights needed to perform the job and organizing those rights around job functions. This is the essence of the principle of least privilege. When you couple that with role-based permissions, you assign permissions to specific roles and then place users into those roles. The result is consistent, auditable access that automatically limits a user to what their role requires, reducing the chance of overreach or accidental data exposure. In practice, least privilege ensures you don’t hand out broad, easy-to-abuse access, while role-based control simplifies management by mapping those precise rights to roles rather than to individuals. Together they form a robust approach to access control that aligns security with everyday work needs. Other approaches exist but don’t match this focused setup as closely. Mandatory access control uses centralized labels and policies that govern all access, often regardless of role. Discretionary access control lets data owners grant access, which can lead to inconsistency and broader access than necessary. Zero trust is a broader security philosophy emphasizing continuous verification and assumed breaches; while it supports least privilege in practice, it’s not the specific mechanism described by restricting access to what’s necessary for a user’s role.

Restricting access to only what is necessary for a user's role relies on granting the minimum rights needed to perform the job and organizing those rights around job functions. This is the essence of the principle of least privilege. When you couple that with role-based permissions, you assign permissions to specific roles and then place users into those roles. The result is consistent, auditable access that automatically limits a user to what their role requires, reducing the chance of overreach or accidental data exposure.

In practice, least privilege ensures you don’t hand out broad, easy-to-abuse access, while role-based control simplifies management by mapping those precise rights to roles rather than to individuals. Together they form a robust approach to access control that aligns security with everyday work needs.

Other approaches exist but don’t match this focused setup as closely. Mandatory access control uses centralized labels and policies that govern all access, often regardless of role. Discretionary access control lets data owners grant access, which can lead to inconsistency and broader access than necessary. Zero trust is a broader security philosophy emphasizing continuous verification and assumed breaches; while it supports least privilege in practice, it’s not the specific mechanism described by restricting access to what’s necessary for a user’s role.