hardMultiple ChoiceObjective-mapped
Least Privilege Violation: Identifying Excessive Permissions
A security auditor discovers that a user has been granted read and write access to a sensitive file, but the user's job only requires read access. Which access control principle has been violated?
Quick Answer
The answer is least privilege, because granting a user write access to a sensitive file when their job only requires read access is a clear least privilege violation involving excessive permissions. This principle mandates that users receive only the minimum access rights necessary to perform their specific tasks, so any additional permissions—like write access here—create unnecessary risk by enabling potential data modification or deletion. On the ISC2 Certified in Cybersecurity CC exam, this concept tests your understanding of core access control models, often appearing in scenario-based questions where you must spot the mismatch between job duties and assigned rights. A common trap is confusing least privilege with separation of duties, but remember: least privilege is about limiting permissions to the bare minimum, not about dividing tasks. To lock it in, think of the mnemonic “MIN” for Minimum Is Necessary—if a permission isn’t strictly required for the role, it’s a violation.
⚠ Common exam trap
ISC2 often tests least privilege by contrasting it with need-to-know, where candidates mistakenly choose need-to-know because both involve limiting access, but least privilege focuses on the permission level (read vs. write) while need-to-know focuses on the data scope.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Least privilege
The principle of least privilege dictates that users should be granted only the minimum permissions necessary to perform their job functions. Granting write access when only read access is required violates this principle by providing unnecessary and potentially harmful capabilities. This is a core access control concept in the CC exam.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Job rotation
Why it's wrong here
Job rotation is a security practice to rotate roles, not directly related to permission levels.
- ✗
Need-to-know
Why it's wrong here
Need-to-know is about data access based on necessity, but here the issue is unnecessary write ability.
- ✗
Separation of duties
Why it's wrong here
Separation of duties divides tasks among multiple people, not about permission levels.
- ✓
Least privilege
Why this is correct
Least privilege requires minimal permissions; write access is excessive.
Go deeper
Related to this question
Learn chapter
Introduction to Security Principles
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
Courseiva writes every CC question from scratch — 976 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CC
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A system administrator notices that a user has been granted read and write permissions to a folder but should only have read access. Which type of access control issue does this represent?
medium- ✓ A.Excessive permissions
- B.Segregation of duties conflict
- C.Authorization creep
- D.Incomplete revocation
Why A: Excessive permissions occur when a user or group is granted more privileges than necessary for their role. In this scenario, the user has read and write access to a folder but should only have read access, meaning the write permission is unnecessary and violates the principle of least privilege. This is a classic example of excessive permissions, as the user has been over-provisioned beyond their job requirements.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.