The correct answer is Role based access control (RBAC).

RBAC is most effective because it assigns permissions to roles that mirror job responsibilities and then assigns users to those roles. This approach enforces the principle of least privilege by ensuring staff only receive the access needed for their duties and it reduces the chance that individuals will have unnecessary or excessive privileges. RBAC also simplifies provisioning and auditing which makes it easier to detect and correct inappropriate access.

Defense in depth is not the best single control for this specific risk because it is a broad strategy of layered defenses rather than a mechanism that directly limits who can access confidential systems. Layering controls helps overall security but it does not by itself prevent staff from having excessive privileges.

Privileged access management is useful for controlling and monitoring high level accounts and sessions but it focuses on managing privileged credentials rather than assigning and enforcing permissions based on job roles across the organization. PAM complements role based access control but it does not replace the role definitions and least privilege enforcement that RBAC provides.

Pre employment screening can reduce the likelihood of hiring malicious insiders but it is an HR preventive measure and it cannot control or limit access once staff have been onboarded. It helps with risk mitigation but it is not the most effective technical control to reduce misuse of confidential systems and data.

Full AWS Practitioner Certification Question