ITPEC FE Subject B April 2026 Question 18

Topic: Security Scenarios

From the answer group below, select the most appropriate combination of answers to be inserted into A and B in the description.

A research laboratory at University Q plans to introduce a cloud-based database to centrally store and manage data for one of its research projects. This database will be used by professors, researchers, students, and administrative staff participating in the project. Table 1 summarizes the data types, descriptions, and the roles and permitted operations for each user group.

Table 1 Data Types and User Requirements (Excerpt)

Data TypeDescriptionUser Roles
Research ProposalsDetailed research plans and objectives- Professors and Researchers create and edit project proposals.- Students can view the proposals to understand the project objectives.- Administrative staff are not permitted to access this data.
Experimental DataRaw and processed experimental results- To maintain data integrity, only Researchers are allowed to create and modify data.- Professors and Students review the data to understand experiment results and research progress.- Administrative staff are not permitted to access this data.

The system administrator at University Q, who is responsible for introducing the database, reviewed the data types and user roles with the information security officer of the university. According to the information security policy of University Q, users must be granted only the permissions necessary for their roles to minimize potential damage in the event of account compromise. Based on this policy, the system administrator created user groups and configured access permissions for each content type. Table 2 lists the resulting access right assignments for the database.

Table 2 Access Right Assignments (Excerpt)

Data TypeProfessorsResearchersStudentsAdministrative Staff
Research ProposalsA(-)
Experimental DataB(-)

Note:

R: Read-only (viewing allowed)

RW: Read and Write (includes creating and modifying)

(-): Not allowed (no access)

Answer group

AB
OptionProfessorsResearchersStudentsProfessorsResearchersStudents

Explanation

A: RW, RW, R; B: R, RW, R — grant each group exactly the operations Table 1 lists for it, as the least-privilege policy requires.

Research Proposals (blank A):

  • •Professors and Researchers create and edit proposals: RW for both
  • •Students only view them: R

Experimental Data (blank B):

  • •only Researchers may create and modify it: RW for them alone
  • •Professors and Students review it: R for both

Administrative staff have no access to either type, which Table 2 already shows.

Answer (c)

Why not others:

  • •(a) and (b) — blank A gives Professors only R on proposals, although they create and edit them
  • •(b), (d) and (f) — blank B gives Professors RW on experimental data, breaking the rule that only Researchers modify it, and denies Students the read access they need
  • •(e) and (f) — blank A denies Students access to proposals, although they view them

Key rule: Least privilege maps each required action to the smallest permission: create, edit or modify means RW, view or review means R, and no stated need means no access.

Security Scenarios · AI-written, may contain errors

Practice this exam

This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.