A new finance application is being deployed, and the business wants to assign access efficiently while limiting the risk of fraud. Which approach BEST meets both goals?
Select an answer to reveal the explanation.
Short Explanation
Role-based access is like a uniform: put on the cashier's uniform and you get the cashier's keys, nothing more. Build the roles so nobody holds both the pen and the checkbook. The trap is copying a colleague's access, which quietly drags along everything they've accumulated.
Full Explanation
Role-based access control groups permissions by job function, so users are assigned roles rather than individual rights. Designing each role on least privilege limits users to what their function requires, and building segregation of duties into the role model prevents one person from both initiating and approving payments, which addresses fraud risk directly. Provisioning becomes efficient because new staff are simply given the appropriate role. Giving all finance staff the same broad access is administratively simple but violates least privilege and removes segregation of duties; monitoring afterward may detect fraud but does not prevent it. Copying an existing user's access, often called mirroring, propagates whatever excess or conflicting permissions that user has accumulated and makes access drift systemic. Letting users request whatever they believe they need shifts design to individual judgment, typically results in excessive rights and produces no consistent, reviewable structure. Exam caveat: role definitions should be approved by the business owner of the application, because owners decide who needs what access while security advises on the control design. Operational check: verify that role definitions are documented and approved, that a conflict matrix identifies incompatible roles, and that provisioning blocks or escalates any assignment that would combine conflicting roles.