Which term defines user authorization levels for resource access?

Which term defines user authorization levels for resource access?

• A. Access Control List (ACL)
• B. Capability List
• C. Role-Based Access Control (RBAC)
• D. Security Labels

Answer: (A)

Access control on a per-resource basis is being examined here. An Access Control List attaches to a resource and enumerates which users or groups are allowed to perform specific actions (read, write, execute, etc.) on that resource. This directly defines the authorization levels for each user with respect to that particular object—the exact map of who can do what with it. Why this fits best: it focuses permission definitions on the resource itself, making who can do what with that resource explicit and granulated. In contrast, Role-Based Access Control assigns permissions to roles (and then users gain access by belonging to those roles), which is more about organizing access around job functions than listing permissions for each resource. Security labels classify data by sensitivity or policy, not who is allowed to access it, and capability lists describe what a subject can access via tokens, which is a different model (bearer-based) rather than an explicit per-resource user list.

Access control on a per-resource basis is being examined here. An Access Control List attaches to a resource and enumerates which users or groups are allowed to perform specific actions (read, write, execute, etc.) on that resource. This directly defines the authorization levels for each user with respect to that particular object—the exact map of who can do what with it.

Why this fits best: it focuses permission definitions on the resource itself, making who can do what with that resource explicit and granulated. In contrast, Role-Based Access Control assigns permissions to roles (and then users gain access by belonging to those roles), which is more about organizing access around job functions than listing permissions for each resource. Security labels classify data by sensitivity or policy, not who is allowed to access it, and capability lists describe what a subject can access via tokens, which is a different model (bearer-based) rather than an explicit per-resource user list.