What is the purpose of access control in information security?

What is the purpose of access control in information security?

• A. To maximize data sharing across all staff.
• B. To monitor user performance.
• C. To limit data access to authorized individuals to protect confidentiality and integrity.
• D. To replace strong authentication with passwords.

Answer: (C)

Access control is about ensuring that information resources are accessible only to people who have permission to use them. It combines verifying who someone is (authentication) with deciding what they are allowed to do (authorization) to protect confidentiality and integrity. By enforcing least privilege and role-based permissions, it prevents unauthorized viewing or modification of data, so sensitive information stays secret and trustworthy. For example, a file might be readable by some staff, writable only by certain roles, and completely inaccessible to others. This way, even if someone gains access to the system, they can’t access everything or change data they shouldn’t. The other ideas don’t fit because increasing data sharing would weaken protections, monitoring performance isn’t the purpose of access control, and using passwords instead of strong authentication actually reduces security.

Access control is about ensuring that information resources are accessible only to people who have permission to use them. It combines verifying who someone is (authentication) with deciding what they are allowed to do (authorization) to protect confidentiality and integrity. By enforcing least privilege and role-based permissions, it prevents unauthorized viewing or modification of data, so sensitive information stays secret and trustworthy.

For example, a file might be readable by some staff, writable only by certain roles, and completely inaccessible to others. This way, even if someone gains access to the system, they can’t access everything or change data they shouldn’t.

The other ideas don’t fit because increasing data sharing would weaken protections, monitoring performance isn’t the purpose of access control, and using passwords instead of strong authentication actually reduces security.