A company wants to protect its network using... | Computer Science (9-1) 0984 | Paper 1 Mock 01 | Computer Systems

Question 1 Report

A company wants to protect its network using different levels of access control.

User role	Access level	Justification
Receptionist	Can view customer contact details only
Sales manager	Can view and edit customer orders and contact details
IT administrator	Full access to all systems and data
Temporary intern	Read-only access to training materials

(a) Complete the table by giving a justification for each user role's access level. [4]

(b) Explain two risks that could arise if all employees were given full access to all data. [4]

Answer

(a) Justification for each user role's access level [4]

User Role	Access Level	Justification
Receptionist	Can view customer contact details only	The receptionist only needs contact details to direct enquiries and schedule appointments. They do not need access to financial records, order data, or other sensitive business information. [1]
Sales manager	Can view and edit customer orders and contact details	The sales manager needs to view customer records to manage client accounts and must be able to edit orders to process new sales, handle returns, and respond to customer queries. [1]
IT administrator	Full access to all systems and data	The IT administrator requires full access to configure systems, install and update software, create and manage user accounts, and troubleshoot problems across the entire network infrastructure. [1]
Temporary intern	Read-only access to training materials	The intern is only in the company for a short period and should have minimal access to reduce the risk of accidental data changes or security breaches. Read-only training materials are sufficient for their learning role. [1]

(b) Two risks if all employees were given full access [4]

Employees could accidentally modify or delete critical data that they are not trained to handle (e.g. a receptionist accidentally editing a financial record), [1] potentially causing serious operational disruption or financial loss that may be difficult or impossible to reverse. [1]
A disgruntled employee with full access could deliberately steal, alter, or destroy sensitive company data. [1] With all users having the same privileges, it would also be much harder to identify the source of a breach from audit logs, since everyone had equal access. [1]

Answer Details

(a) Justification for each user role's access level [4]

User Role	Access Level	Justification
Receptionist	Can view customer contact details only	The receptionist only needs contact details to direct enquiries and schedule appointments. They do not need access to financial records, order data, or other sensitive business information. [1]
Sales manager	Can view and edit customer orders and contact details	The sales manager needs to view customer records to manage client accounts and must be able to edit orders to process new sales, handle returns, and respond to customer queries. [1]
IT administrator	Full access to all systems and data	The IT administrator requires full access to configure systems, install and update software, create and manage user accounts, and troubleshoot problems across the entire network infrastructure. [1]
Temporary intern	Read-only access to training materials	The intern is only in the company for a short period and should have minimal access to reduce the risk of accidental data changes or security breaches. Read-only training materials are sufficient for their learning role. [1]

(b) Two risks if all employees were given full access [4]

Employees could accidentally modify or delete critical data that they are not trained to handle (e.g. a receptionist accidentally editing a financial record), [1] potentially causing serious operational disruption or financial loss that may be difficult or impossible to reverse. [1]
A disgruntled employee with full access could deliberately steal, alter, or destroy sensitive company data. [1] With all users having the same privileges, it would also be much harder to identify the source of a breach from audit logs, since everyone had equal access. [1]

A company wants to protect its network using different levels of access control. User role Access level Justification Receptionist Can view customer contact...