(A) Incorrect — authentication succeeded; the denial was at the authorization step.

(C) Incorrect — this is an application-level access control decision, not a network-level segmentation issue.

(D) Incorrect — the system denied access at the application level; encryption is a different protection mechanism.

(A) Incorrect — DAC puts permission decisions in individual users’ hands, which is inconsistent and unscalable for 2,000 people.

(B) Incorrect — MAC uses military-style classification levels; it is too rigid and complex for a civilian school environment.

(D) Incorrect — unrestricted access violates FERPA and exposes student PII to every staff member regardless of need.

(A) Incorrect — educational software should be deployed centrally by IT, not installed by individual teachers with admin rights.

(C) Incorrect — the risk is far beyond cosmetic changes; admin access enables complete system compromise.

(D) Incorrect — security updates should be managed centrally (WSUS, SCCM); relying on teachers to patch is unreliable and creates inconsistency.

(B) Incorrect — permissions typically persist until manually removed; they do not auto-expire.

(C) Incorrect — organizations change constantly; roles evolve, staff move positions, and new systems are added.

(D) Incorrect — excess permissions do not significantly affect system performance.

(A) Incorrect — zero trust is a security architecture principle, not a vendor procurement strategy.

(B) Incorrect — zero trust INCREASES verification at every access point; it does not remove controls.

(D) Incorrect — zero-knowledge encryption is a cryptographic technique; zero trust is an access control philosophy.