SY0-701 General Security Concepts Practice Question
Which three of the following are characteristics of the principle of least privilege? (Choose three.)
⚠ Common exam trap
Test-takers frequently confuse the principle of least privilege with the concept of 'zero trust' or mistakenly think that permanent privilege grants are acceptable if initially assigned correctly, ignoring the need for ongoing review and revocation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Users are granted only the permissions necessary to perform their job functions
The principle of least privilege dictates that users should only have the minimum permissions necessary to complete their job functions, which reduces the attack surface and limits potential damage from compromised accounts. Administrative accounts should be reserved exclusively for administrative tasks to prevent accidental or malicious misuse of elevated privileges. Regularly reviewing and revoking privileges ensures that access rights remain aligned with current job requirements, preventing privilege creep.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Users are granted only the permissions necessary to perform their job functions
Why this is correct
This is the core definition of least privilege. It minimizes the attack surface by ensuring each user account has only the specific rights and permissions needed for their assigned tasks. For example, a helpdesk technician may have password reset rights but not permission to modify firewall rules. This limits the potential damage from compromised accounts or insider misuse.
- ✓
Administrative accounts are used only for administrative tasks, not daily work
Why this is correct
This is a practical application of least privilege that separates privileged and non-privileged operations. Administrators should log in with a standard user account for routine activities like email or browsing, and use a separate admin account only when performing administrative functions. This reduces the risk of accidentally executing a malicious file with elevated privileges and helps preserve the integrity of administrative credentials.
- ✓
Privileges are reviewed and revoked when no longer needed
Why this is correct
Least privilege is a dynamic principle, not a one-time assignment. Organizations must periodically audit user permissions, especially after role changes or departures, and promptly remove access that is no longer required. This prevents privilege creep, where users accumulate access rights over time, and ensures that former employees cannot retain access to sensitive systems.
- ✗
All users have equal access to all system resources
Why it's wrong here
This directly contradicts least privilege. Uniform access for every user means no differentiation based on job function, which would allow a junior employee to access executive payroll data or critical infrastructure controls. It also violates the need-to-know principle and vastly expands the attack surface, since every user account becomes a potential entry point to every resource.
- ✗
Privileges are granted permanently once assigned
Why it's wrong here
Least privilege requires that privileges be time-boxed and tied to the current job role. Permanent grants are dangerous because users may change roles, leave the organization, or their responsibilities may evolve. Without periodic revocation, dormant accounts with elevated permissions become a prime target for attackers seeking persistent, high-level access.
- ✗
Users are given full control over all shared folders
Why it's wrong here
Granting full control to all users on every shared folder is the antithesis of least privilege. It would allow any user to read, modify, or delete files they have no business touching, including confidential documents or system configurations. Proper file permission management should grant granular rights like read-only where appropriate, and full control only to the few who actually need it.
Go deeper
Related to this question
Learn chapter
Access Control Models (DAC, MAC, RBAC)
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
Key term
Attack surface
The attack surface is the total sum of all points in a system, network, or application where an unauthorized user can try to enter or extract data.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.