Explanation/Reference:
Explanation:
Role-based access control (RBAC) is a model where access to resources is determines by job role rather than by user account.
Hierarchical RBAC allows the administrator to set up an organizational RBAC model that maps to the organizational structures and functional delineations required in a specific environment. This is very useful since businesses are already set up in a personnel hierarchical structure. In most cases, the higher you are in the chain of command, the more access you will most likely have.
Role relation defines user membership and privilege inheritance. For example, the nurse role can access a certain amount of files, and the lab technician role can access another set of files. The doctor role inherits the permissions and access rights of these two roles and has more elevated rights already assigned to the doctor role. So hierarchical is an accumulation of rights and permissions of other roles.
Reflects organizational structures and functional delineations.
Incorrect Answers:
A: Access control lists form the basis of access control; they determine who can access what. However,
"access control lists" on its own is not a model that maps to the organizational structures and functional delineations required in a specific environment.
B: Discretionary access control is a model where the subjects must have the discretion to specify what resources certain users are permitted to access. This is not a model that maps to the organizational structures and functional delineations required in a specific environment.
D: Non-mandatory access control is not a defined access control model. It would imply any access model that is not mandatory access control.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, 2013, pp. 224-226