AP Cybersecurity Drill 23: File Permissions for Confidential Reports

Question 1. Reading Source 1, which file currently violates the policy by granting access to others?

• A) client_a.txt, whose permission string ends in three dashes that withhold every kind of access from the others class
• B) client_b.txt only, because the owner field and the group field both happen to name the same account
• C) None of them, since each file is owned by jpatel and the analysts group, exactly as the policy expects
• D) client_b.txt and client_c.txt, because the others section of each grants read, or read-write-execute, access ✓

Explanation: Choice D is correct. The last three characters are the others permissions: client_b.txt shows r-- (others can read) and client_c.txt shows rwx (others can read, write, and execute), so both grant access the policy forbids. Choice A is incorrect because client_a.txt ends in --- and correctly gives others nothing. Choice B is incorrect because matching owner and group names is irrelevant and client_b is not the only violator. Choice C is incorrect because two files clearly over-grant to others.

Question 2. In a permission string such as -rwxrwxrwx, the three permission groups read in which order?

• A) Group first, then others, then owner, with the single leading character marking the file's owner name
• B) Others first, then group, then owner, so the rightmost three characters always describe the file's owner
• C) Owner first, then group, then others, after a leading character that marks the file type in the listing ✓
• D) Owner first, then others, then group, with the middle three characters describing the world or everyone

Explanation: Choice C is correct. After the leading file-type character, permissions are read as owner, then group, then others, each as an rwx triad. Choice A is incorrect because owner comes first, not group, and the leading character marks file type, not an owner name. Choice B is incorrect because owner is the first triad, not the last. Choice D is incorrect because group, not others, is the middle triad.

Question 3. Which octal mode sets exactly the policy: owner read-write, group read, others none?

• A) chmod 644, which would also leave the others class with read access that the policy explicitly forbids
• B) chmod 640, giving the owner read and write, the group read only, and the others class no access at all ✓
• C) chmod 600, which removes the group's read access even though the policy requires the analysts group to read
• D) chmod 660, which would additionally grant the group write access that the policy does not call for

Explanation: Choice B is correct. Owner rw is 6, group r is 4, others none is 0, so 640 matches the policy exactly. Choice A is incorrect because 644 gives others read, which the policy forbids. Choice C is incorrect because 600 denies the group the read access the policy requires. Choice D is incorrect because 660 grants the group write, which the policy does not allow.

Question 4. Why does the current setting on client_c.txt create the most serious risk of the three?

• A) Because anyone in the others class can read and modify the file, so the report can be altered without authorization ✓
• B) Because the file name happens to end in the letter c, which signals to the system that the file holds compiled program code
• C) Because the file is owned by jpatel, and assigning any single person ownership of a report is itself a direct policy breach
• D) Because the analysts group has read access, and group read is the permission that exposes a file most widely

Explanation: Choice A is correct. The rwx for others lets any account read, modify, and execute the confidential report, which threatens both confidentiality and integrity, the worst exposure of the three files. Choice B is incorrect because the file extension does not set permissions or imply executable code. Choice C is incorrect because single-owner files are normal and required by the policy. Choice D is incorrect because group read is exactly what the policy intends and is not the source of the risk.

Question 5. What is the best fix that brings all three files into compliance while following least privilege?

• A) Run chmod 777 on all three so every file behaves the same way and no future permission mismatch can occur
• B) Rename all three files with less obvious names and leave their individual permission bits unchanged
• C) Leave client_a.txt as is, since it already complies, and stop, because one compliant file is enough for the audit
• D) Set client_b.txt and client_c.txt to 640, matching client_a.txt and granting only policy-required access ✓

Explanation: Choice D is correct. client_a.txt already meets the policy; setting the other two to 640 gives the owner read-write, the group read, and others nothing, which is the least privilege the policy specifies. Choice A is incorrect because 777 grants everyone full access, the opposite of least privilege. Choice B is incorrect because renaming files does not change their permission bits, so the over-grants remain. Choice C is incorrect because two files still violate the policy and must be fixed.