For each role, which two elements must be defined regarding access?

For each role, which two elements must be defined regarding access?

• A. Which system components they may access.
• B. The level of privilege required for accessing resources.
• C. The required data retention period.
• D. Both system components and data resources they need to access and the privilege level.

Answer: (D)

The essential idea is that each role’s access must be defined by two things: which system components the role may reach and what privilege level is required to interact with those resources. By specifying both, you enforce least privilege and need-to-know, ensuring a person can do their job without gaining unnecessary access. Defining the systems or components a role can access clarifies the scope of that role—for example, which parts of the payment processing or monitoring interfaces are allowed. Defining the privilege level clarifies what actions are permitted on those components—such as read-only versus write or admin rights. Together, these two elements map exactly what data or resources a role can touch and what operations they can perform. If you only define the components, you might know where someone can log in but not what they’re allowed to do there. If you only define the privileges, you might know what actions are allowed but not which systems or data are accessible. The data retention period is a separate policy about how long data is kept and isn’t part of access control. So the best approach for each role is to specify both the system components they may access and the privilege level required to access the resources.

The essential idea is that each role’s access must be defined by two things: which system components the role may reach and what privilege level is required to interact with those resources. By specifying both, you enforce least privilege and need-to-know, ensuring a person can do their job without gaining unnecessary access.

Defining the systems or components a role can access clarifies the scope of that role—for example, which parts of the payment processing or monitoring interfaces are allowed. Defining the privilege level clarifies what actions are permitted on those components—such as read-only versus write or admin rights. Together, these two elements map exactly what data or resources a role can touch and what operations they can perform.

If you only define the components, you might know where someone can log in but not what they’re allowed to do there. If you only define the privileges, you might know what actions are allowed but not which systems or data are accessible. The data retention period is a separate policy about how long data is kept and isn’t part of access control.

So the best approach for each role is to specify both the system components they may access and the privilege level required to access the resources.