SY0-701 General Security Concepts Practice Question
An analyst on the HR application team needs access to a production database replica only long enough to verify a column-mapping issue. The analyst should not be able to browse salary fields, export tables, or keep access after the task ends. Which principle best matches the desired access model?
⚠ Common exam trap
Many candidates confuse least privilege with need-to-know: least privilege limits permissions (e.g., read-only vs. write), while need-to-know limits the specific data content (e.g., excluding salary fields) and duration, which is the precise requirement in this question.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Need-to-know
The need-to-know principle restricts access to only the information required to perform a specific task. In this scenario, the analyst needs access to verify a column-mapping issue but must not see salary fields, export tables, or retain access afterward. Need-to-know ensures access is limited to the exact data and duration necessary, which aligns with granting temporary, scoped access to a production database replica without broader data exposure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Least privilege
Why it's wrong here
Least privilege is a principle that limits a user's permissions to the minimum necessary to perform their job function. While the analyst should not have more system rights than required, the stem focuses on restricting visibility to specific sensitive data fields (e.g., salary) rather than general system permissions. Least privilege addresses what actions a user can take on a system, but need-to-know more precisely controls which data elements a user can access, even within an authorized application. Thus, least privilege is related but does not capture the fine-grained data-level restriction described in the question.
- ✓
Need-to-know
Why this is correct
The analyst only needs a narrow slice of information for a specific task and should not be able to see unrelated sensitive fields. That is need-to-know. It focuses on limiting data visibility to what is required for the assignment. Least privilege is related, but the clue about salary fields and specific data exposure makes need-to-know the best answer.
- ✗
Separation of duties
Why it's wrong here
Separation of duties is a security principle that requires critical tasks to be divided among multiple individuals to prevent fraud or errors, ensuring no single person has full control over a process. The stem describes a single analyst needing access to specific HR data for a legitimate assignment, not a process that must be split across multiple roles. This principle is about preventing conflicts of interest and unauthorized end-to-end actions, not about restricting data visibility to only the fields required for a task. Therefore, separation of duties does not apply to the scenario of granting data access to an individual analyst.
- ✗
Defense in depth
Why it's wrong here
Defense in depth is a security strategy that employs multiple, overlapping layers of protection across the organization (network, host, application, data) to provide redundancy in case one control fails. The stem describes a single access-control decision: what specific data an analyst can see in an HR application. While need-to-know could be enforced through one layer of a defense-in-depth strategy, the principle itself is not about layering mechanisms; it is about the granularity of data exposure based on job necessity. Thus, defense in depth is too broad and generic for the specific data-visibility requirement described.
Go deeper
Related to this question
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A contractor is assigned to a single merger project. The manager approves access to only the project share and the project chat space, even though the contractor technically could use other collaboration tools. Which principle is most directly reflected?
medium- A.Need-to-know
- ✓ B.Least privilege
- C.Integrity
- D.Zero trust
Why B: Least privilege is the principle of granting users only the access rights and permissions necessary to perform their job functions. The contractor is given access only to the project share and project chat space, while being denied access to other collaboration tools they technically could use. This directly reflects least privilege, as the manager is limiting the contractor's system and resource access to the minimum required for the merger project.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.