Role-based access control is correct because it links access permissions to the employee's role within the organization. In this case, as a 'Marketing Analyst,' Maya would have access rights specific to her role, which enables her to perform her job functions. Least privilege model is incorrect as it is a principle and not a method. Custom user settings refer to individual settings tailored for a user and are not based on roles. Unrestricted access would grant Maya more permissions than necessary, violating security best practices.