Exam CRISC topic 1 question 993 discussion

Agree it is B. Role based would help with insiders, MFA helps with outsiders.

Cant be role based threat actor notes is an outsider and not insider.

Role-based access controls are a security mechanism that restricts access to data and resources based on the user's role in the organization. This ensures that only authorized users can access and modify application data. Users are granted access to specific data based on their job function, and they can only perform actions that are necessary to perform their job. In contrast, multi-factor authentication is a security mechanism that requires users to provide two or more forms of identification, such as a password and a one-time code, to access systems or applications. While multi-factor authentication is an effective security control, it is primarily designed to prevent unauthorized access to systems and applications, rather than controlling what users can do within those systems and applications.