The scenario where lab staff can see tests and results, while billing staff can only see charges demonstrates which type of control?

• A. Audit trail
• B. Authentication
• C. Access
• D. Authorization

Answer: (C)

Access control focuses on regulating who can reach which data and resources. In this scenario, different staff roles have different visibility: lab personnel can view tests and results, while billing personnel are limited to charges. That selective visibility is exactly what access control aims to enforce, applying the principle of least privilege so each user can only access what they need. Authentication is about proving who you are, which happens before access decisions are made. Authorization is the process of granting those permissions; the observable outcome here is the controlled access to data, hence the concept of access. Audit trails would log actions, not determine who can see what data. So the best fit is access control, which governs data visibility based on role.