The correct answer is least privilege because the employee’s ability to access files outside their project folder shows they have been granted permissions beyond what their job requires. The principle of least privilege mandates that users and processes receive only the minimum access necessary to perform their specific duties, so any excess permissions create a direct violation. On the ISC2 Certified in Cybersecurity CC exam, this scenario tests your understanding of how least privilege prevents unauthorized data exposure, often appearing in questions about access control failures. A common trap is confusing least privilege with need-to-know, but remember: least privilege limits permissions, while need-to-know limits information access. For a real-world example, think of a hospital where a receptionist can view patient schedules but not medical records—that’s least privilege in action. Memory tip: “Least means least—only what’s needed, nothing more.”
ISC2 CC Security Principles Practice Question
This CC practice question tests your understanding of security principles. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A security administrator notices that an employee is able to access files in a project folder they should not have access to. Which security principle is being violated?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Least privilege
The scenario describes an employee accessing files they should not have access to, which directly violates the principle of least privilege. This principle mandates that users and processes should be granted only the minimum permissions necessary to perform their job functions. The administrator's observation indicates that the employee's access rights exceed what is required, leading to unauthorized file access.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Least privilege
Why this is correct
Least privilege means users get only necessary permissions; unauthorized access violates this.
Related concept
Read the scenario before looking for a memorised answer.
✗
Non-repudiation
Why it's wrong here
Non-repudiation prevents denial of actions; it is not about access controls.
✗
Separation of duties
Why it's wrong here
Separation of duties prevents fraud by splitting critical tasks; it is not directly related to unauthorized access.
✗
Defense in depth
Why it's wrong here
Defense in depth uses multiple security layers; it does not address excessive permissions.
Common exam traps
Common exam trap: answer the scenario, not the keyword
ISC2 often tests least privilege by presenting a scenario where a user has more access than needed, and candidates may confuse it with separation of duties because both involve access control, but the key distinction is that least privilege focuses on the level of access per user, while separation of duties focuses on dividing responsibilities among multiple users.
Detailed technical explanation
How to think about this question
Under the hood, least privilege is enforced through access control lists (ACLs) on file systems (e.g., NTFS permissions in Windows or inode-based permissions in Linux) and role-based access control (RBAC) in directory services like Active Directory. A common subtlety is that group memberships can inadvertently grant cumulative permissions, leading to privilege creep if not regularly audited. In real-world scenarios, a developer might be added to a 'Project X' group for a temporary task but never removed, allowing continued access to sensitive financial data long after the task is complete.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A security analyst at a medium-sized enterprise encounters this scenario during an investigation or architecture review. The correct answer reflects best practice for the specific threat or control described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Security exam questions test whether you can match controls to threats in context — not just recall definitions.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this CC question in full detail.
Security Principles — This question tests Security Principles — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Least privilege — The scenario describes an employee accessing files they should not have access to, which directly violates the principle of least privilege. This principle mandates that users and processes should be granted only the minimum permissions necessary to perform their job functions. The administrator's observation indicates that the employee's access rights exceed what is required, leading to unauthorized file access.
What should I do if I get this CC question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A system administrator must grant a help desk technician the ability to reset user passwords but not change user roles. Which security principle does this scenario enforce?
easy
A.Accountability
✓ B.Principle of least privilege
C.Need-to-know
D.Non-repudiation
Why B: Least privilege ensures users have only the permissions needed. Granting password reset but not role changes limits permissions to the job function. Option A is correct. Option B (need-to-know) limits data access. Option C (accountability) tracks actions. Option D (non-repudiation) ensures actions can't be denied.
Variation 2. An organization is developing a security policy that defines the rules for acceptable use of company resources. Which principle should guide the creation of this policy to ensure it is enforceable and effective?
easy
A.Non-repudiation
B.Defense in depth
✓ C.Least privilege
D.Separation of duties
Why C: Least privilege minimizes risk by granting only necessary access. Other principles are less relevant for policy enforcement.
Variation 3. A security analyst notices that a user has been granted access to files beyond their job function. Which principle is violated?
easy
✓ A.Least privilege
B.Authentication
C.Non-repudiation
D.Accountability
Why A: Least privilege requires that users be granted only the minimum permissions necessary to perform their duties. The scenario shows excessive access, directly violating this principle.
Variation 4. A company implements role-based access control (RBAC) to ensure users have only the permissions necessary for their job roles. This is an example of:
medium
✓ A.Least privilege
B.Defense in depth
C.Separation of duties
D.Need-to-know
Why A: RBAC enforces least privilege by granting permissions based on roles. Option A (Separation of duties) divides tasks. Option B (Need-to-know) restricts data access. Option C (Defense in depth) is layering controls.
Variation 5. A company has implemented a role-based access control (RBAC) system. A new employee in the finance department is granted the 'Finance User' role, which allows them to view invoices but not create payments. However, after a system upgrade, it is discovered that the 'Finance User' role now includes the ability to create payments due to a misconfiguration. The employee did not request this additional privilege and has not exploited it. The security team is notified. Which principle has been violated, and what is the most appropriate immediate action?
hard
A.Separation of duties; disable the employee's account until an investigation is complete
B.Accountability; remove the 'Finance User' role from all employees
C.Least privilege; revoke the employee's access permanently
✓ D.Least privilege; correct the role permissions to only what is necessary
Why D: Correct: Least privilege is violated because the employee has more permissions than needed. The immediate action is to correct the role permissions and revert the misconfiguration (C). Option A is wrong because the employee did not misuse the privilege; Option B is wrong because disabling the account prevents work; Option D is wrong because removing the role altogether is too broad.
Last reviewed: Jun 30, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.