In the context of access control, what does RBAC stand for and how does it determine access?

• A. RBAC grants access based on defined job roles.
• B. DAC lets owners grant access at the discretion of resource owner; MAC enforces system-wide policies regardless of user desire; RBAC grants access based on defined job roles.
• C. RBAC is discretionary; DAC is role-based; MAC is user-based.
• D. DAC lets owners grant access at the discretion of resource owner.

Answer: (B)

RBAC stands for Role-Based Access Control. Access is determined by the roles assigned to a user; each role has a defined set of permissions, and a user gains those permissions by being in that role. When a user tries to perform an action, the system checks whether any of their roles include the needed permission. If it does, access is allowed; if not, it’s denied. This approach centralizes authorization around job responsibilities, making it easier to manage as people move between roles and to enforce least privilege by granting permissions through roles rather than individually. In contrast, discretionary access control relies on resource owners to grant permissions at their discretion, and mandatory access control enforces system-wide policies independent of individual user desires.