Which statement describes how access should be assigned with respect to job role and minimal privileges?

Which statement describes how access should be assigned with respect to job role and minimal privileges?

• A. Access rights should not consider job function.
• B. Access should be assigned based on job role and the minimum privileges necessary.
• C. Access should be the same for all roles.
• D. Access should be granted only after annual review.

Answer: (B)

The fundamental idea being tested is least privilege combined with role-based access control: access is granted based on a person’s job role and limited to what is necessary to perform that role. This aligns with PCI DSS requirements to restrict access by function and need-to-know, reducing the chance of unnecessary or excessive access. Why this is the best approach: assigning access based on the job role and the minimum privileges necessary ensures individuals can perform their duties without being able to reach data or systems they don’t need. It protects sensitive cardholder data and minimizes risk if an account is compromised. Why the other notions don’t fit: not considering job function would grant broad access regardless of responsibilities, increasing risk. giving the same access to everyone ignores different duties and the principle of least privilege. waiting to grant access until an annual review delays necessary permissions and doesn’t ensure access is tightly matched to current job needs (though annual reviews are important for verification).

The fundamental idea being tested is least privilege combined with role-based access control: access is granted based on a person’s job role and limited to what is necessary to perform that role. This aligns with PCI DSS requirements to restrict access by function and need-to-know, reducing the chance of unnecessary or excessive access.

Why this is the best approach: assigning access based on the job role and the minimum privileges necessary ensures individuals can perform their duties without being able to reach data or systems they don’t need. It protects sensitive cardholder data and minimizes risk if an account is compromised.

Why the other notions don’t fit: not considering job function would grant broad access regardless of responsibilities, increasing risk. giving the same access to everyone ignores different duties and the principle of least privilege. waiting to grant access until an annual review delays necessary permissions and doesn’t ensure access is tightly matched to current job needs (though annual reviews are important for verification).