Cyber Security and Digital Currency: Question 5
Syllabus 5.3
A hospital's computer system lets receptionists view a patient's appointment history, but only specialist doctors are allowed to view and edit that patient's full medical records, using the same login system.
Which security solution most directly achieves this difference in what receptionists and doctors can do once logged in?
Show worked solution Hide worked solution
Worked solution
Step 1: Identify what the scenario needs
Both receptionists and doctors log into the same system, so the issue is not about proving who they are. It is about controlling what each type of logged-in user is allowed to do. Receptionists can only view appointment history, while doctors can view and edit full medical records.
Step 2: Match each option to what it actually controls
- Two-step verification confirms a user’s identity when logging in, for example a password plus a code; it does not decide what a confirmed user can then see or change.
- Access levels give different logged-in users different permissions, for example read-only access for one role and full read/edit access for another, based on who they are.
- Anti-malware software detects and removes malicious software; it has nothing to do with permissions between legitimate members of staff.
- Automating software updates keeps software patched against known weaknesses; it does not control what different staff can view or edit.
Step 3: Confirm the answer
Only access levels directly create the difference described: the same login system, but different permissions (view-only vs view-and-edit) depending on the user’s role.
Final answer
The security solution is access levels, option B.