Question

Arturo is a network engineer. He wants to implement an access control system in which the owner of the resource decides who can change permissions, and permission levels can be granted to specific users, groups of people in the same or similar job roles, or by project. Which of the following should Arturo choose?

a) Rule-Based Access Control (RBAC)
b) Mandatory Access Control (MAC)
c) Role-Based Access Control (RBAC)
d) Discretionary Access Control (DAC)

Answer 1

Arturo should choose Role-Based Access Control (RBAC) for implementing the access control system. RBAC allows the owner of the resource to assign permissions based on the role of the user. It provides a granular level of control over access rights, making it suitable for complex environments with multiple users and resources.

Step-by-step explanation:

Arturo should choose Role-Based Access Control (RBAC) for implementing the access control system. RBAC allows the owner of the resource to assign permissions based on the role of the user. This means that Arturo can grant specific permissions to users, groups, or projects based on their job roles or project involvement.

RBAC is a flexible and scalable access control model that is widely used in network security. It provides a granular level of control over access rights, making it suitable for complex environments with multiple users and resources. For example, in a company, Arturo can assign different access levels to employees based on their positions, such as giving managers higher permissions than regular employees.

In contrast, Rule-Based Access Control (RBAC) is a different access control model that makes use of specific rules or conditions to determine access permissions. Discretionary Access Control (DAC) grants the owner of the resource full control over access permissions, allowing them to change permissions at their discretion. Mandatory Access Control (MAC) relies on system-defined security classifications and labels to control access.