A university SD-WAN team needstiered Manager access where NOC staff monitor alarms only, senior engineers change policies, and auditors view reports without edits. The solution must enforce least privilege and track actions. Which capability describes user groups and role-based access control in the Manager?
Select an answer to reveal the explanation.
Short Explanation
Shared logins turn auditing into guesswork, and that's a headache you'll feel at review time. Role-based groups hand each team only the keys they need. Least privilege keeps everyone honest.
Full Explanation
The correct capability is accurate because Manager user groups with role-based access control enforce least privilege by mapping NOC, senior engineering, and audit responsibilities to distinct menus, tasks, and device scope, allowing alarm monitoring, policy changes, and report review respectively while individual logins make actions attributable. Integrated single sign-on with multifactor authentication is a standard secure practice that verifies administrator identity, yet it provides authentication without authorization and therefore fails to create tiered permissions, leaving privilege excessive. Read-only operator accounts are commonly used to safely support monitoring and review, yet uniform read-only access blocks senior engineers from required policy edits and fails differentiated capability. Detailed audit logging is a standard detective control that records timestamps for views and changes to support tracking, yet it does not prevent unauthorized edits because it lacks preventive restriction of tasks. An exam caveat is that least privilege plus tracking requires both scoped authorization and attributable identity, so authentication-only, read-only-only, or logging-only answers remain incomplete despite being best practices. A practical check is to log in as each group, verify only expected menus appear, attempt a prohibited policy edit to confirm denial, and review the audit trail for correct identity attribution.