ITPEC FE Morning April 2021 Question 39

Least Privilege for Database Access Rights — assign the minimum access right needed for the application's functions.

The application only retrieves and displays data (i.e., SELECT). Three access levels are defined:

• •Reference right — permits SELECT (read-only)
• •Update right — permits INSERT, UPDATE, DROP records
• •Administrator right — permits CREATE, ALTER, DROP tables

Since the application only reads data, Reference right is sufficient.

Why not others:
- (a) Administrator right — allows DDL operations (CREATE, ALTER, DROP tables), far beyond what is needed
- (c) Update right — allows data modification (INSERT, UPDATE, DROP records), which is unnecessary for a read-only app
- (d) Update right and reference right — Update right is excessive; Reference right alone covers SELECT

Key rule: Apply the principle of least privilege — grant only the permissions the application actually needs.

AI-generated — may contain errors