mediumMultiple Choice
200-201 Practice Question: A system administrator needs to grant access to a…
A system administrator needs to grant access to a database for a new employee. According to the principle of least privilege, what should be done?
⚠ Common exam trap
200-201 often tests whether candidates confuse least privilege with approval workflows or temporary elevation — the trap is picking 'grant no access until approval' (a process control) or 'temporary admin' (elevation) instead of the minimum-necessary-access principle itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Grant only the minimum required permissions
The principle of least privilege states that users should be granted only the minimum access necessary to perform their job functions, and no more. For a new employee needing database access, the correct action is to grant only the minimum required permissions (A) — scoped to the specific database objects and operations the role demands. This limits the blast radius of compromise or error and satisfies least privilege.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Grant only the minimum required permissions
Why this is correct
Least privilege requires granting the new employee only the specific database permissions their role needs, nothing broader. This limits potential damage from error or credential compromise, satisfying the stated principle rather than assigning fixed roles or default access.
- ✗
Grant temporary admin access
Why it's wrong here
Temporary admin access exceeds the rights the employee's database role requires, breaching least privilege regardless of duration. Least privilege scopes permissions to the job function, not to a time limit. It tempts because temporary elevation feels contained, but the privilege level itself is the violation, not its lifespan.
- ✗
Grant no access until manager approves
Why it's wrong here
Withholding all access until a manager approves leaves the employee unable to work and does not itself implement least privilege, which concerns the scope of granted rights, not approval workflow. It tempts as a cautious default, but least privilege means granting the minimum necessary, not zero pending sign-off.
- ✗
Grant full access and remove later
Why it's wrong here
Granting full access then trimming later violates least privilege by exposing the entire database during the gap before review. Least privilege requires starting from the minimum rights the role needs. It tempts because temporary broad grants feel convenient for onboarding, yet the exposure window is exactly what the principle exists to eliminate.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.