Kernel can be thought of having a kernel domain. Its rights include read and write to its own address space, but its rights do not include read or write to any other processes' address space. In UNIX, each user is associated a protection domain. In UNIX, everytime a user starts a process, the process runs in the protection domain associated with the user.
Every operation made by the process is checked against the rights in that protection domain.
However, studentA would not be able to cat the file since his or her protection domain does not have the rights. If a file has its setuid bit being 1, then when a process is created using this file as the binary executable, the process runs in the protection domain associated with the owner of the file, not the user who creates the process. That person can then do anything to the system. For this reason, the CSL checks regularly all system binaries on the department machines to make sure that they have not been changed. Another way is to trick the system administrator to create a file with the administrator as the owner and the setuid bit as 1.