ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

In RBAC, permissions are attached to roles and are evaluated when a user activates a role. To restrict access to a specific subset of objects, the cleanest solution is to create a new, more restrictive role whose permission set is limited to those spreadsheets and to assign only the managers to it. Because roles can be combined, managers keep the general Finance role for ordinary files while their additional, object-specific role grants them exclusive access to the sensitive objects. Switching to a different control model (MAC or ABAC), adding deny permissions to every non-manager, or embedding user accounts in ACLs all either depart from RBAC or impose far greater administrative burden and risk of error.