7. A company enforces role-based access control (RBAC) to ensure employees can only access information related to their job duties. Which AAA category does this apply to?
Answer: D
Role-based access control (RBAC) applies to Authorization.
Role-based access control (RBAC) is a security mechanism that restricts system access to authorized users. This is a clear application of the Authorization category within the AAA framework, as it determines what resources a user can access based on their assigned roles.
A) Authentication
Authentication is the process of verifying the identity of a user before granting access to a system. While it is a crucial part of security, it does not involve controlling access to specific resources based on job duties, making it incorrect in this context.
B) Accounting
Accounting refers to tracking user activities and resource usage within a system. Although it plays a role in security management, it does not dictate access permissions, which is the focus of the question regarding access control based on job roles.
C) Auditing
Auditing involves reviewing and analyzing records of user activity to ensure compliance and detect anomalies. While important for security oversight, it does not pertain to the proactive control of access rights, which is central to the concept of RBAC.
D) Authorization
Authorization is the process of granting or denying access to resources based on established permissions. In the context of RBAC, it is specifically about controlling what information employees can access based on their roles, making it the correct answer.
Conclusion
The correct answer is Authorization, as it directly relates to the principles of role-based access control in determining user access to resources. Authentication, Accounting, and Auditing, while important components of the AAA framework, do not involve the direct assignment of access rights based on job responsibilities, thus failing to meet the requirements of the question.