ITPEC IP April 2023 Question 18
ITPEC IP April 2023 — Question 18 of 100
Access rights should be defined for combinations of users and data so each user sees only what confidentiality and business need permit. Authorization can be assigned through roles, groups, views, row-level rules, column privileges, or policies. This supports least privilege while keeping one controlled database rather than distributing uncontrolled copies.
Answer (a)
Why not others:
- (b) per-user database copies create duplication, synchronization, and leakage risks
- (c) permanently dedicating columns to each user is inflexible and does not handle row-level needs well
- (d) record-by-record passwords are impractical and do not provide manageable centralized authorization
Key rule: Authenticate the user, then authorize access according to identity or role and the sensitivity of the requested data.
AI-generated — may contain errors
The original exam layout is preserved in the image so diagrams, formulas, tables, and code remain accurate.
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official IP past-paper collection or Report an issue.