Which statement best describes an effective access control practice for public records?

Which statement best describes an effective access control practice for public records?

• A. Open access to all records for all staff
• B. Public access without authentication
• C. Anonymous or shared credentials for multiple users
• D. Implement strong authentication, role-based access, and audit trails

Answer: (D)

The main idea here is controlling who can access public records while ensuring actions are traceable. The best practice is to require strong authentication, assign access based on roles, and keep audit trails of every access or change. Strong authentication verifies exactly who is logging in, so you’re not relying on guesses. Role-based access restricts users to the specific records they need for their duties, following the principle of least privilege. Audit trails document who accessed or modified records and when, providing accountability and a foundation for investigations or compliance reviews. Why the other options don’t fit: opening access to all staff or making records publicly accessible without authentication would expose sensitive information and remove accountability. Anonymous or shared credentials make it impossible to tell who performed an action, which undermines security and governance. Using strong authentication, RBAC, and audit trails together gives secure, accountable, and compliant handling of public records.

The main idea here is controlling who can access public records while ensuring actions are traceable. The best practice is to require strong authentication, assign access based on roles, and keep audit trails of every access or change. Strong authentication verifies exactly who is logging in, so you’re not relying on guesses. Role-based access restricts users to the specific records they need for their duties, following the principle of least privilege. Audit trails document who accessed or modified records and when, providing accountability and a foundation for investigations or compliance reviews.

Why the other options don’t fit: opening access to all staff or making records publicly accessible without authentication would expose sensitive information and remove accountability. Anonymous or shared credentials make it impossible to tell who performed an action, which undermines security and governance.

Using strong authentication, RBAC, and audit trails together gives secure, accountable, and compliant handling of public records.