Match each access principle to the best description.
Drag a concept onto its matching description — or click a concept then click the description.
Give the user only the permissions needed to do the job.
Share only the information required for the assigned task.
Split important steps so one person cannot complete everything alone.
Verify each request instead of trusting a user just because they are internal.
Use multiple protective layers so one failure does not expose everything.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Least privilege: Users get minimal permissions needed
Least privilege grants minimal permissions, separation of duties splits critical tasks, defense in depth uses multiple security layers, need-to-know restricts data access, RBAC assigns permissions by role, and accountability ensures traceability.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Least privilege: Users get minimal permissions needed
Why this is correct
Least privilege is a core security principle that restricts a user, program, or process to only the access rights and permissions absolutely necessary to complete their assigned tasks. By granting minimal entitlements, it reduces the attack surface and limits the potential damage from credential compromise, insider threats, or software vulnerabilities. This principle is a foundational control in zero trust architectures and regulatory frameworks such as HIPAA, which mandate access aligned with job functions.
Least privilege: Splitting critical tasks among multiple people
Why it's wrong here
This statement confuses least privilege with separation of duties, a fraud-deterrence control that divides sensitive processes among multiple individuals. For example, requiring one person to approve a vendor invoice and another to issue the check prevents a single rogue employee from initiating and completing an unauthorized payment. Least privilege, in contrast, never concerns itself with task distribution; it only dictates the magnitude and scope of an individual's permissions, irrespective of how many people are involved.
Separation of duties: Users get minimal permissions
Why it's wrong here
Assigning users only the minimal permissions to perform their job is the definition of least privilege, not separation of duties. Separation of duties is a procedural safeguard that splits critical functions so that no one person has unchecked control over an entire transaction, such as combining the roles of an operator and an auditor. Therefore, this mislabel incorrectly equates a permission-limiting control with a task-splitting control, which addresses different risks and operational goals.
Defense in depth: Multiple layers of security
Why this is correct
Defense in depth is a layered security approach that employs multiple, independent controls across physical, technical, and administrative domains to protect an asset. If one control fails, another control at a different layer or with a different mechanism still blocks or mitigates an attack, creating redundancy and resilience. This strategy is exemplified by combining network firewalls, host-based intrusion detection, data encryption, and security awareness training, so that an attacker must defeat several obstacles to succeed.
Need-to-know: Access only to information necessary for job duties
Why this is correct
Need-to-know restricts information access to individuals whose job duties explicitly require that specific data, even if they have high-level clearance or broad authorization. It emphasizes the data content itself, rather than the level of privilege, ensuring that an employee handling accounts cannot view contracts or personnel files unless their role demands it. This principle is essential in compartmented environments like military intelligence, where access to certain programs is strictly limited to those directly involved.
Quick reference
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Learn chapter
Security Controls
Key term
RBAC
RBAC is a method of restricting network access based on the roles of individual users within an organization, where permissions are assigned to roles rather than to individuals directly.
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.