Roger is a nurse who works in a medical facility with multiple practices. The specific practice he works for has four doctors, and Roger could treat patients for any of those four doctors depending on the day. If there is a patient being treated by the practice where he works, but necessarily not by Roger himself, _________ would allow him access to patient records, but following _________ would prevent him from accessing the records .

Question

Roger is a nurse who works in a medical facility with multiple practices. The specific practice he works for has four doctors, and Roger could treat patients for any of those four doctors depending on the day. If there is a patient being treated by the practice where he works, but necessarily not by Roger himself,  _________ would allow him access to patient records, but following _________ would prevent him from accessing the records .

BlackTom AI · Accepted Answer

Least privilege grants users only the minimal access rights required to perform their job, while need-to-know restricts access further to only the specific information required for a particular task or patient.

1) Relevant knowledge points and concepts
- Least privilege: a security principle that assigns users only the privileges necessary for their role, reducing exposure to unrelated data.
- Need-to-know: an additional, finer-grained control that allows access only when the user has a specific, legitimate requirement for that particular item of information (e.g., the current caregiver of a patient).
- Permissions: a generic term for access controls but not a distinct principle that explains patient-specific restriction.

2) Step-by-step reasoning
- Roger is a nurse employed by a practice with four doctors; his role in the practice implies baseline duties that may require access to patient records for treatment tasks.
- Apply least privilege: assign Roger the minimal set of records access consistent with his role as a nurse at the practice. That baseline can permit access to practice patient records he must handle as part of his job schedule.
- Apply need-to-know: even if his role permits general practice-level access, the need-to-know principle restricts access to records only for patients he is actively treating. If a patient is being treated by the practice but not by Roger specifically, need-to-know would deny his access.

3) Intermediate logic (no numeric calculations)
- Role-based minimal access (least privilege) → may allow practice-level record access.
- Task-specific justification (need-to-know) → requires direct caregiving assignment before access is allowed.
- Therefore, least privilege allows access in the general role sense, but need-to-know prevents access when Roger is not the treating clinician.

4) Why the correct answer is correct
- The first blank is "least privilege" because that principle grants role-appropriate minimal access (so as a nurse he can access what his role necessitates). The second blank is "need to know" because that principle stops access unless Roger specifically needs that patient’s record for his assigned care.

5) Why the other options are incorrect
- "Need to know, least privilege" reverses the logic and would imply need-to-know allows access and least privilege prevents it—incorrect.
- "Need to know, permissions" mixes a principle with a generic term; permissions do not specifically describe the more restrictive patient-assignment rule.
- "Least privilege, permissions" names the correct first principle but uses a vague term for the second; the specific restricting principle is need-to-know.

6) Conclusion
The correct choice is least privilege, need to know, matching the provided answer.

类似问题

What are user permissions?

What are user permissions?

In order to achieve the system protection, a process should access

During an audit of an internally developed, web-based purchase approval application, an IS auditor discovers that all business users share a common access profile. Which of the following is the MOST important recommendation for the IS auditor to include in the report?

A company recently hired you as a system administrator. You notice that some accounts that were set up for temporary employees who are no longer working at the company are currently enabled. Which of the following is the BEST thing to do?

What are user permissions?

An employee, Alex, needs access to a critical database containing sensitive project files. Alex's role requires read-only access to specific project folders, not full control over the entire database. What security principle is most relevant?

An auditor is reviewing whether employees who accessed the HR database last month used that access only for approved purposes. This review is most closely related to the data security principle of _____.

更多留学生实用工具

智能学习助手

风格化写作助手

论文查重助手

文献引用助手

课堂转译助手

课堂笔记助手

Quiz搜索助手

学校历年真题

智能刷题助手

智能匹配练习

希望你的学习变得更简单