For a project to migrate an employee qualification management system to web technologies, the following...

Acceptance criteria should define how the system behaves for a given user story or requirement. They must be precise, testable, and directly traceable to the requirement being verified.

REQ 3-12 describes access control for three user types. Option B is a concrete, scenario-based acceptance criterion that tests the enforcement of access rights — making it an ideal match.

Other options:

A is irrelevant — database technology (MongoDB) is an implementation detail, not a functional criterion.

C is too vague — stating that security tests must be performed doesn’t specify expected behavior or outcome.

D is plausible, but option B more directly demonstrates how an actual system behavior validates the requirement.

Answer: B. Since I am logged in as a department manager, when I try to access the file of an employee who is not in my department then a message telling me that I do not have access rights is displayed