Worked Solution
✓ VerifiedAnswer: (b)
The revised access control mechanisms like passwords and biometrics mentioned in the case are based on the principle of Least Privilege. This principle mandates that users and operators should be granted only the minimum level of access rights necessary to perform their assigned job functions. In the context of MPETL, this means operators and administrators would receive specific, limited access to system resources proportionate to their roles, rather than unrestricted access to all systems. By implementing the Principle of Least Privilege, the company restricts unauthorized access, reduces the risk of data compromise, and mitigates potential misuse of computing resources. This principle directly addresses MPETL's vulnerability where poor restrictions previously allowed unauthorized disclosure or malicious use of data.
Write it like this
1The skeleton
- Read the case trigger words first — 'specified system access rights for operators and administrators' is the examiner's planted signal pointing directly to Least Privilege; circle it before looking at options.
- Eliminate the distractors fast — Need-to-Know is about information, not system resource rights; Separation of Duties splits tasks, not access levels; knock these out in 10 seconds.
- Lock in (b) and move on — your confirmation logic: passwords + biometrics restrict WHO gets in, Least Privilege restricts HOW MUCH they get once inside; the case mentions both, so the principle tying them is Least Privilege.
2Examiner-rewarded phrases
3Common trap
Watch out — most students confuse 'Need to Know' with 'Least Privilege' here because both sound restrictive; the difference is Need to Know governs information access (data), while Least Privilege governs system resource rights (what you can DO on the system) — the case explicitly says 'use of computer system resources', so it's Least Privilege, not Need to Know.