200-201 Security Policies and Procedures Practice Question
A company is updating its security policy to align with the principle of least privilege. The IT director asks the security analyst to recommend a control that enforces this principle for user access to a financial application. Which control should the analyst recommend?
⚠ Common exam trap
It's easy for candidates to confuse authentication controls like SSO and MFA with authorization controls that enforce least privilege, when the question specifically asks for an access control method to limit permissions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Role-based access control (RBAC) that grants permissions based on job functions.
The principle of least privilege requires that users have only the minimum access necessary to perform their job functions. Role-based access control (RBAC) achieves this by defining roles with specific permissions and assigning users to roles. This limits access based on job needs and simplifies administration. Other controls like MAC, DAC, or SSO/MFA do not directly enforce least privilege for application access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Single sign-on (SSO) with multifactor authentication (MFA).
Why it's wrong here
SSO and MFA improve authentication security and user convenience, but they do not by themselves enforce least privilege. A user could authenticate strongly and still have excessive access rights. Least privilege is about authorization and limiting permissions, not just verifying identity. While MFA is important, it does not address the access control requirement in the scenario.
- ✗
Mandatory access control (MAC) using sensitivity labels on all data.
Why it's wrong here
MAC is typically used in high-security environments where labels and clearances determine access. While it enforces strict control, it is not the most common or practical recommendation for a typical financial application. MAC requires extensive labeling and administration, which may be overkill. The scenario asks for a control to enforce least privilege, and RBAC is more directly aligned and commonly implemented.
- ✗
Discretionary access control (DAC) where data owners set permissions.
Why it's wrong here
DAC allows data owners to grant access at their discretion, which can lead to excessive privileges and does not consistently enforce least privilege. Users might grant broad access to others, violating the principle. DAC is common in file systems but is not the best choice for a structured financial application where strict role separation is needed. RBAC is more appropriate.
- ✓
Role-based access control (RBAC) that grants permissions based on job functions.
Why this is correct
RBAC enforces least privilege by assigning permissions to roles, not individuals, and users are granted only the roles needed for their job. This limits access to what is required to perform duties. It is a standard method to implement least privilege in applications. The financial application scenario fits RBAC because access can be tied to job functions like teller, auditor, or manager.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.