Which model assigns access rights to roles rather than to individuals?

• A. Discretionary access control
• B. Role-based access control
• C. Mandatory access control
• D. Policy-based access control

Answer: (B)

The main idea here is how access rights are organized in a model. In this model, permissions are assigned to roles rather than to individual users, and users gain access by being placed in those roles. This makes managing permissions scalable in larger organizations and helps enforce consistent access by grouping duties and responsibilities.

Discretionary access control ties permissions to individual owners, giving them freedom to grant access to others. Mandatory access control relies on fixed policies and security labels set by the system, not by user roles. Policy-based access control uses policies to decide access, which can encompass various strategies but doesn’t fixedly attach rights to roles.