ITPEC FE Subject A April 2025 Question 28
A given application only has the functions of retrieving and displaying user information from a database that stores such information. When considering information security, which of the following is the appropriate database access right assigned to an account that the application uses to access the database? The names and scopes of rights are listed below.
[The names and scopes of rights]
Explanation
Reference right — an application that only retrieves and displays data needs nothing beyond permission to select records.
The principle of least privilege gives an account only the rights its function requires. This application only reads user information, and the reference right is exactly the permission to select a record. If the application is ever compromised, for example through SQL injection, an attacker using its account can read but cannot change, delete or restructure data.
Answer (b)
Why not others:
- •(a) Administrator right — adds creating, altering and dropping tables, far beyond reading records
- •(c) Update right — allows insert, update and drop of records but not select, so the application could not even retrieve the data it displays
- •(d) Update right and reference right — would work, but grants write access the application never uses, breaking least privilege
Key rule: Grant each account the smallest set of rights its function needs; any extra right only widens the damage if the account is misused.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.