easyMultiple Choice
Understanding Least Privilege with a Real-World Scenario
A security administrator notices that an employee is able to access files in a project folder they should not have access to. Which security principle is being violated?
Quick Answer
The correct answer is least privilege because the employee’s ability to access files outside their project folder shows they have been granted permissions beyond what their job requires. The principle of least privilege mandates that users and processes receive only the minimum access necessary to perform their specific duties, so any excess permissions create a direct violation. On the ISC2 Certified in Cybersecurity CC exam, this scenario tests your understanding of how least privilege prevents unauthorized data exposure, often appearing in questions about access control failures. A common trap is confusing least privilege with need-to-know, but remember: least privilege limits permissions, while need-to-know limits information access. For a real-world example, think of a hospital where a receptionist can view patient schedules but not medical records—that’s least privilege in action. Memory tip: “Least means least—only what’s needed, nothing more.”
⚠ Common exam trap
ISC2 often tests least privilege by presenting a scenario where a user has more access than needed, and candidates may confuse it with separation of duties because both involve access control, but the key distinction is that least privilege focuses on the level of access per user, while separation of duties focuses on dividing responsibilities among multiple users.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Least privilege
The scenario describes an employee accessing files they should not have access to, which directly violates the principle of least privilege. This principle mandates that users and processes should be granted only the minimum permissions necessary to perform their job functions. The administrator's observation indicates that the employee's access rights exceed what is required, leading to unauthorized file access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Least privilege
Why this is correct
Least privilege grants users only the access required for their role. The employee reaching files outside their project folder shows permissions exceeding that minimum, so the principle is breached regardless of whether the access was intentional.
- ✗
Non-repudiation
Why it's wrong here
Non-repudiation proves a party performed an action, typically via signatures or audit logs; it does not govern whether a subject is authorised to read a folder. It tempts because logging supports accountability, and would be violated if a user could deny sending a message or approving a transaction.
- ✗
Separation of duties
Why it's wrong here
Separation of duties splits a sensitive task across multiple people so no single person completes it alone; the scenario concerns one employee's excessive folder permissions, not task splitting. It tempts as a foundational access-control principle, and would apply if one administrator could both request and approve their own access.
- ✗
Defense in depth
Why it's wrong here
Defence in depth layers multiple independent controls; the failure here is a single authorisation check permitting access to a folder the employee should not reach. It tempts because layered controls reduce breach impact, and would be the answer if one control failed while others still blocked the access.
Go deeper
Related to this question
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
Key term
Project
A project is a temporary endeavor with a defined beginning and end, undertaken to create a unique product, service, or result, managed through specific processes in IT environments.
About these practice questions
Courseiva writes every CC question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
5 more ways this is tested on CC
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A system administrator must grant a help desk technician the ability to reset user passwords but not change user roles. Which security principle does this scenario enforce?
easy- A.Accountability
- ✓ B.Principle of least privilege
- C.Need-to-know
- D.Non-repudiation
Why B: The principle of least privilege dictates that users are granted only the minimum access rights necessary to perform their job functions — no more. Granting the help desk technician the ability to reset passwords but explicitly withholding the ability to change user roles is a textbook application of this principle, because role changes are a more privileged operation than password resets. This limits the blast radius if the technician's account is compromised.
Variation 2. An organization is developing a security policy that defines the rules for acceptable use of company resources. Which principle should guide the creation of this policy to ensure it is enforceable and effective?
easy- A.Non-repudiation
- B.Defense in depth
- ✓ C.Least privilege
- D.Separation of duties
Why C: Least privilege minimizes risk by granting only necessary access. Other principles are less relevant for policy enforcement.
Variation 3. A security analyst notices that a user has been granted access to files beyond their job function. Which principle is violated?
easy- ✓ A.Least privilege
- B.Authentication
- C.Non-repudiation
- D.Accountability
Why A: The principle of least privilege states that users should be granted only the minimum access rights necessary to perform their job functions. Granting access to files beyond that scope directly violates this principle. This is a foundational access control concept in security frameworks like ISO 27001 and NIST.
Variation 4. A company implements role-based access control (RBAC) to ensure users have only the permissions necessary for their job roles. This is an example of:
medium- ✓ A.Least privilege
- B.Defense in depth
- C.Separation of duties
- D.Need-to-know
Why A: RBAC grants users only the permissions required for their job roles, which is the definition of least privilege — the principle that subjects should have the minimum access necessary to perform their function.
Variation 5. A company has implemented a role-based access control (RBAC) system. A new employee in the finance department is granted the 'Finance User' role, which allows them to view invoices but not create payments. However, after a system upgrade, it is discovered that the 'Finance User' role now includes the ability to create payments due to a misconfiguration. The employee did not request this additional privilege and has not exploited it. The security team is notified. Which principle has been violated, and what is the most appropriate immediate action?
hard- A.Separation of duties; disable the employee's account until an investigation is complete
- B.Accountability; remove the 'Finance User' role from all employees
- C.Least privilege; revoke the employee's access permanently
- ✓ D.Least privilege; correct the role permissions to only what is necessary
Why D: The misconfiguration granted the employee more permissions than required, violating the principle of least privilege. The most appropriate immediate action is to correct the role permissions so they include only what is necessary, restoring least privilege without unnecessarily punishing the employee. Since the employee did not request or exploit the privilege, permanent revocation or account disablement is disproportionate.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.