Which statement best defines RBAC in the context of user account management?

• A. Access is granted to everyone by default.
• B. Role-Based Access Control assigns permissions based on role; users get roles granting necessary privileges while minimizing excess.
• C. Biometric authentication is required for all logins.
• D. Password policies manage only expiration.

Answer: (B)

RBAC is about granting access based on a user’s role, so permissions are tied to job functions rather than to individuals. This lets administrators assign a user to a role (such as Employee, Manager, or System Administrator), and that role carries exactly the privileges needed to perform the duties, minimizing excess access. If a person’s role changes or they leave, access is updated by changing or removing that role, making management scalable and audits straightforward. The other statements don’t capture how access is controlled: granting access to everyone by default ignores least privilege; requiring biometrics relates to authentication, not authorization; and password policies focus on credential rules rather than who can do what after logging in.