easyMultiple ChoiceObjective-mapped
Understanding Least Privilege with a Real-World Scenario
A security administrator notices that an employee is able to access files in a project folder they should not have access to. Which security principle is being violated?
Quick Answer
The correct answer is least privilege because the employee’s ability to access files outside their project folder shows they have been granted permissions beyond what their job requires. The principle of least privilege mandates that users and processes receive only the minimum access necessary to perform their specific duties, so any excess permissions create a direct violation. On the ISC2 Certified in Cybersecurity CC exam, this scenario tests your understanding of how least privilege prevents unauthorized data exposure, often appearing in questions about access control failures. A common trap is confusing least privilege with need-to-know, but remember: least privilege limits permissions, while need-to-know limits information access. For a real-world example, think of a hospital where a receptionist can view patient schedules but not medical records—that’s least privilege in action. Memory tip: “Least means least—only what’s needed, nothing more.”
⚠ Common exam trap
ISC2 often tests least privilege by presenting a scenario where a user has more access than needed, and candidates may confuse it with separation of duties because both involve access control, but the key distinction is that least privilege focuses on the level of access per user, while separation of duties focuses on dividing responsibilities among multiple users.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Least privilege
The scenario describes an employee accessing files they should not have access to, which directly violates the principle of least privilege. This principle mandates that users and processes should be granted only the minimum permissions necessary to perform their job functions. The administrator's observation indicates that the employee's access rights exceed what is required, leading to unauthorized file access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Least privilege
Why this is correct
Least privilege means users get only necessary permissions; unauthorized access violates this.
- ✗
Non-repudiation
Why it's wrong here
Non-repudiation prevents denial of actions; it is not about access controls.
- ✗
Separation of duties
Why it's wrong here
Separation of duties prevents fraud by splitting critical tasks; it is not directly related to unauthorized access.
- ✗
Defense in depth
Why it's wrong here
Defense in depth uses multiple security layers; it does not address excessive permissions.
Go deeper
Related to this question
Learn chapter
Introduction to Security Principles
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
Key term
Project
A project is a temporary endeavor with a defined beginning and end, undertaken to create a unique product, service, or result, managed through specific processes in IT environments.
About these practice questions
Courseiva writes every CC question from scratch — 976 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
5 more ways this is tested on CC
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A system administrator must grant a help desk technician the ability to reset user passwords but not change user roles. Which security principle does this scenario enforce?
easy- A.Accountability
- ✓ B.Principle of least privilege
- C.Need-to-know
- D.Non-repudiation
Why B: Principle of least privilege. This principle ensures that users are granted only the permissions necessary to perform their job functions. Granting password reset but not role changes adheres to least privilege. Option A (accountability) involves tracking actions to specific users. Option C (need-to-know) restricts access to information based on necessity. Option D (non-repudiation) ensures actions cannot be denied.
Variation 2. An organization is developing a security policy that defines the rules for acceptable use of company resources. Which principle should guide the creation of this policy to ensure it is enforceable and effective?
easy- A.Non-repudiation
- B.Defense in depth
- ✓ C.Least privilege
- D.Separation of duties
Why C: Least privilege minimizes risk by granting only necessary access. Other principles are less relevant for policy enforcement.
Variation 3. A security analyst notices that a user has been granted access to files beyond their job function. Which principle is violated?
easy- ✓ A.Least privilege
- B.Authentication
- C.Non-repudiation
- D.Accountability
Why A: Least privilege requires that users be granted only the minimum permissions necessary to perform their duties. The scenario shows excessive access, directly violating this principle.
Variation 4. A company implements role-based access control (RBAC) to ensure users have only the permissions necessary for their job roles. This is an example of:
medium- ✓ A.Least privilege
- B.Defense in depth
- C.Separation of duties
- D.Need-to-know
Why A: RBAC enforces least privilege by granting users only the permissions necessary for their roles. Option A is Least privilege, which limits permissions to the minimum required. Option B (Defense in depth) involves multiple layers of security. Option C (Separation of duties) divides critical tasks among different individuals. Option D (Need-to-know) restricts access to data based on necessity.
Variation 5. A company has implemented a role-based access control (RBAC) system. A new employee in the finance department is granted the 'Finance User' role, which allows them to view invoices but not create payments. However, after a system upgrade, it is discovered that the 'Finance User' role now includes the ability to create payments due to a misconfiguration. The employee did not request this additional privilege and has not exploited it. The security team is notified. Which principle has been violated, and what is the most appropriate immediate action?
hard- A.Separation of duties; disable the employee's account until an investigation is complete
- B.Accountability; remove the 'Finance User' role from all employees
- C.Least privilege; revoke the employee's access permanently
- ✓ D.Least privilege; correct the role permissions to only what is necessary
Why D: Correct: Least privilege is violated because the employee has more permissions than needed. The immediate action is to correct the role permissions to only what is necessary (option D). Option A is wrong because separation of duties is not the violated principle; the employee did not misuse the privilege, so disabling the account is too extreme. Option B is wrong because accountability is not the issue, and removing the role from all employees is overly broad. Option C is wrong because revoking the employee's access permanently is too harsh and does not address the root cause.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.