Question

Which among the following is not a primary rule of role based access control?

(a) Role definition

(b) Role assignment

(c) Role authorization

(d) Permission authorization

The question was asked in a job interview.

This interesting question is from Next Generation Wireless Network in division Next Generation Wireless Network of Cognitive Radio

Answer 1

The correct answer is:

(d) Permission authorization

Explanation:

In Role-Based Access Control (RBAC), there are key rules for managing and controlling access based on roles within an organization or system. These primary rules include:

1. Role definition: Defining the roles in the system. Each role corresponds to a set of permissions or access rights, usually based on job functions.

2. Role assignment: Assigning specific roles to users or entities. A user can have one or more roles, which determine what actions they can perform in the system.

3. Role authorization: Determining which roles are allowed to access which resources or actions. This involves defining and enforcing access policies for each role.

Permission authorization, on the other hand, is not a primary rule in RBAC. While roles are assigned permissions, the permission itself is not authorized directly through RBAC rules—permissions are granted to roles, and roles are authorized to perform actions based on the policies set for each role.

Thus, permission authorization (option d) is not a primary rule of role-based access control, and the correct answer is (d).