Question 75

Explanation

The correct answer: Change his access to HR-specific access: In Role-Based Access Control (RBAC), users are assigned roles based on their job responsibilities and functions, and these roles define their access to the system's resources. When an employee changes departments or roles within a company, their access rights need to be updated to match their new role. In this case, the employee is moving from IT to HR. Therefore, the appropriate action would be to change his access to HR-specific access. His new role in HR would have different responsibilities and requirements than his previous role in IT, and his system access should reflect this. By doing so, you ensure the employee has the necessary access to perform their HR duties while also adhering to the principle of least privilege, which states that users should have the minimum levels of access necessary to perform their job functions. This also helps minimize the risk of misuse of access or data leaks. The incorrect answers: Remove his access completely: Removing his access completely would be incorrect because it would prevent the employee from performing his new role within the HR department. Although the employee's role has changed, he still needs access to company resources: just different resources than before. The purpose of RBAC is not to remove access, but to assign appropriate access based on an individual's role within the organization. Change his access to IT-specific access: This answer is also incorrect. The employee is moving from IT to HR, so giving or maintaining IT-specific access would not align with his new job responsibilities in HR. His access should match his current role, which is in HR, not IT. Maintaining access to IT resources increases potential security risks, as the employee could have access to sensitive IT information that is no longer relevant to his role. Leave his access as is: Leaving his access as it is would also be incorrect in this scenario. If his access remained the same, the employee would still have access to IT resources and wouldn't necessarily have the appropriate access for his new role in HR. This approach doesn't adhere to the principles of RBAC or the principle of least privilege, and it could lead to potential data security issues or unnecessary access to information and resources. It could also hinder the employee's ability to effectively perform their new HR role.