Consider the following general code for allowing access to a resource:

DWORD dwRet = IsAccessAllowed ( . . . ) ;

if (dwRet == ERROR_ACCESS_DENIED) { // Security check fa ile d .

// Inform user that access is denied .

} else {

// Security check OK.

}

a) Explain the security flaw in this program.

b) Rewrite the code to avoid the flaw (Hint: Consider the design principle of fail-safe defaults).