A retail chain wants every cashier to receive the same point-of-sale rights without an administrator editing dozens of permissions on each new account. Which control does that job?
Select an answer to reveal the explanation.
Short Explanation
You do not retune every lock each time a new cashier is hired. You put the cashier in the point-of-sale role, and the rights already hang on that role, which is role-based access control. Least privilege is the rule about how much access the role should contain, not the name of the role machinery itself.
Full Explanation
Role-based access control assigns permissions to a role and then places accounts into that role. The retail chain defines a point-of-sale role once, grants those rights to the role, and adds each cashier to it. A new account inherits the bundle without an administrator editing dozens of individual permissions. That is the mechanism the staffing pattern needs. Least privilege is the separate principle that the role should contain only the access the job requires. It does not name the machinery that groups people by job. Discretionary access is the tempting opposite: someone edits permissions on each account, which is the work the chain wants to stop. Separation of duties splits a sensitive job so one person cannot complete it alone. It does not give every cashier the same rights. Exam caveat: a role can still violate least privilege if the point-of-sale role also includes unrelated administrator rights. The role is the assignment tool, and the contents of the role still have to be justified. Operational check: compare two cashier accounts, confirm both are members of the point-of-sale role, confirm the rights live on the role, and confirm a new cashier gains them by membership alone.