CCNA Network Services and Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  It limits users and administrators to the permissions they actually need.

  Why this is correct

  Least privilege is a security principle that grants each subject—whether a standard user or an administrator—only the minimum rights required to perform their assigned job function. By scoping privileges to explicit job requirements, the organization reduces the attack surface and prevents privilege escalation that results from standing high-level access. This principle is implemented through role-based access control, where permissions are assigned according to defined roles rather than individual preferences.

• ✓

  It helps reduce unnecessary exposure and the impact of mistakes or misuse.

  Why this is correct

  Limiting permissions shrinks the blast radius of incidents, so a compromised or erroneous account can only affect the resources and actions within its narrow authorization scope. If an administrator makes a typographical error or a user accidentally deletes data, the damage is confined because the account lacks rights to broader systems. This containment directly mitigates the severity of insider threats, phishing attacks, and misconfigurations.

• ✗

  It means no administrator should ever have any configuration access.

  Why it's wrong here

  Least privilege does not prohibit administrators from having configuration access; rather it mandates that their access be tailored to the specific administrative tasks they own. An administrator responsible for network device configuration still needs permissions to modify those devices, but not to unrelated systems like the financial database. The principle is about necessity and scope, not total denial of administrative capability.

  When this WOULD be correct

  If the exam question were to ask about a security policy that mandates a complete separation of duties, stating that no administrator should have any configuration access could be correct in a context where strict segregation is enforced to prevent unauthorized changes.

• ✗

  It replaces the need for logging and accounting.

  Why it's wrong here

  Least privilege and accounting are complementary, not substitutes, because even a minimally privileged account can perform unauthorized actions or make mistakes that must be detected and traced. Logging and accounting provide the visibility to verify that privileges are being used appropriately and to reconstruct events after an incident. Removing logging would blind the organization to misuse, defeating the very risk-reduction purpose of least privilege.

  When this WOULD be correct

  In a question focused on the principles of security management, asking whether least privilege can negate the need for logging and accounting in a specific context, such as a highly controlled environment where access is strictly monitored, could make this option correct if the premise is that logging is deemed unnecessary due to other security measures.

• ✗

  It exists only on wireless guest networks.

  Why it's wrong here

  Least privilege is a universal access-control principle that applies to all network environments, including wired LANs, data centers, cloud infrastructure, and server administration, not just wireless guest networks. Guest networks often enforce it for unauthenticated visitors, but the principle governs how privileges are assigned to users, devices, and processes across the entire enterprise. Confining least privilege to a single wireless scenario misrepresents its foundational role in identity and access management.

  When this WOULD be correct

  If the exam question specifically asked about security measures applicable only to wireless guest networks, then this option could be correct. For example, a question might state, 'What security principle is primarily focused on limiting access in wireless guest network scenarios?'

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”