Match each principle to the scenario that best illustrates it.
Drag a concept onto its matching description — or click a concept then click the description.
A database account can update records but cannot approve purchases.
A contractor can view only the log source tied to the assigned ticket.
One person prepares a wire transfer and another authorizes it.
The portal checks the device and user again before each sensitive action.
The application is protected by MFA, filtering, and endpoint controls.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Least privilege: A user is given only the permissions needed to perform their job.
Least privilege limits access rights; separation of duties divides critical tasks; defense in depth uses multiple security layers; need to know restricts data access; accountability tracks actions; fail safe ensures security on failure.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Least privilege: A user is given only the permissions needed to perform their job.
Why this is correct
Least privilege is the principle that a user should be granted only the exact permissions and access rights required to perform their assigned job functions, and nothing more. This minimizes the attack surface by preventing users from accessing sensitive data or systems that are irrelevant to their role, reducing the potential impact of accidental or malicious misuse. In practice, this means applying role-based access control (RBAC) with fine-grained permissions, and regularly reviewing and revoking privileges when roles change. This scenario is correct because it directly aligns with the definition of least privilege, unlike scenarios involving multi-person approval which map to separation of duties.
Separation of duties: Two people are required to approve a financial transaction.
Why this is correct
Separation of duties is an internal control that requires a critical task to be divided among two or more individuals, ensuring that no single person has end-to-end authority over a sensitive process. Requiring two people to approve a financial transaction creates a checks-and-balances mechanism, because the second approver independently verifies the legitimacy of the transaction, which deters fraud, errors, and unauthorized payments. This principle relies on a division of responsibilities rather than merely limiting permissions, and is a common requirement in financial auditing and regulatory compliance frameworks. This scenario is correct because it exemplifies the essence of separation of duties, not least privilege or defense in depth.
Defense in depth: A network uses firewalls, antivirus, and encryption.
Why this is correct
Defense in depth is a security strategy that employs multiple, overlapping layers of protection so that if one control fails or is bypassed, another control is still in place to mitigate the threat. In this scenario, a network using firewalls, antivirus, and encryption represents distinct layers: the firewall filters traffic at the network boundary, antivirus detects malicious code at the host level, and encryption protects data at rest and in transit. These layers work together to provide redundancy and increase the overall complexity and effort required for an attacker to compromise the system. This scenario is correct because the use of multiple, diverse security controls across different layers is the defining characteristic of defense in depth.
Least privilege: Two people are required to approve a financial transaction.
Why it's wrong here
This scenario actually describes separation of duties, not least privilege. The key feature is that a financial transaction requires the involvement of two distinct individuals to approve it, which is exactly how separation of duties prevents a single person from committing fraud. Least privilege, by contrast, would focus on ensuring that each of those two individuals only has permissions necessary for their specific approval role, but the scenario does not mention permission minimization at all. Thus, calling this least privilege is incorrect because it confuses a multi-user control with an access-rights principle.
Separation of duties: A user is given only the permissions needed to perform their job.
Why it's wrong here
This scenario describes least privilege, not separation of duties. The defining attribute is that the user's permissions are deliberately limited to only what is required to perform their job, which is the core of least privilege. Separation of duties, on the other hand, involves breaking a process into multiple steps that must be performed by different individuals to prevent any one person from controlling a complete transaction. Since this scenario lacks any division of tasks among multiple people, attributing it to separation of duties is a misclassification of the two principles.
Defense in depth: An employee accesses customer data only when required for their role.
Why it's wrong here
This scenario illustrates the principle of need-to-know or least privilege, not defense in depth. An employee accessing customer data only when required for their role is an example of restricting access based on job necessity, which is a access-control principle aimed at reducing unnecessary exposure to sensitive information. Defense in depth, however, is about layering multiple independent security mechanisms—such as firewalls, intrusion detection, endpoint protection, and encryption—to protect the system as a whole. Confusing these two concepts is a common mistake because both involve security, but they operate at fundamentally different levels: one is about authorization, the other about redundant controls.
Go deeper
Learn chapter
Security Controls
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.