This approach is the best because it ensures that users have the minimum level of access required to perform their job functions, which reduces the risk of unauthorized access or misuse of dat a. User roles are defined based on the business needs and responsibilities of the users, and they can be easily managed and audited.
Reference:
answer : "Defining access privileges based on user roles is the best approach because it allows the data owner to assign the minimum level of access required for each role and to review and update the roles periodically" (p. 23).