Allow different users to upload pdf to nodes privately
Creating two content types "Question" and "Answer" seems to be the right approach per me. These two could be related via entity reference fields. And the storage of the file fields should be "private" for the implementing the access control. I have recently written about private files in my answer you might check out.