ITPEC IP October 2023 Question 41

Topic: SecurityAlso asked in October 2018 and November 2021

In a file system that uses the access control methods below, which of the following settings for access rights to file A satisfies the requirements for access control?

[Access control methods of the file system]•Units for the setting of access rights: Owner; Users in the same group as the owner; Other users•Access rights: R (Read), W (Write), X (Execute)•Priority of access rights: From highest priority to lowest, settings are prioritized in the order of “Owner”; “Users in the same group as the owner”; “Other users”
[Requirements for access control to file A]•All users are able to execute the file.•Only the owner and users in the same group as the owner are able to read from the file.•Only the owner is able to write to the file.

*: Set  –: Not set

OwnerUsers in the same group as the ownerOther users
OptionRWXRWXRWX

Explanation

Owner R W X, group R X, others X only — read each requirement as one right and grant it only to the classes it names.

ClassRWX
Ownersetsetset
Same groupset–set
Other users––set
  • •Execute for all users → X set for all three classes
  • •Read only for owner and group → R set for owner and group, not for others
  • •Write only for the owner → W set for the owner alone

The priority rule only decides which class applies to a user who fits more than one (the owner is also in the owner's group): the owner's row wins, so each user gets exactly one row. Only option (d) matches every cell.

Answer (d)

Why not others:

  • •(a) — gives the group W, so users in the group could write, breaking "only the owner"
  • •(b) — gives other users R, so anyone could read the file
  • •(c) — gives other users R and W but not X, breaking all three requirements for them

Key rule: Grant each class only the rights a requirement explicitly gives it (least privilege); "only X can" means the right is withheld from every other class.

Security · AI-written, may contain errors

Practice this exam

This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official IP past-paper collection or Report an issue.