ISC2 CC Security Principles Practice Question
A software development team is designing a new application that will process credit card payments. The security architect recommends that the application should not store the card verification value (CVV) after the transaction is authorized. Which principle is the architect applying?
⚠ Common exam trap
The trap here is selecting least privilege because it sounds security-related, when the scenario is actually about limiting what data is stored rather than who can access it.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data minimization
The architect recommends not retaining the CVV after the transaction, which reduces the amount of sensitive data the application holds. This is data minimization, the practice of limiting collection and retention to what is necessary. Least privilege is about access rights, separation of duties is about dividing tasks, and defense in depth is about layered controls, so data minimization is the correct principle.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Least privilege
Why it's wrong here
Least privilege gives users and processes only the minimum access rights needed to perform their tasks. While related to security, it applies to permissions rather than data retention. The scenario is about not storing CVV, not about limiting who can access it. Least privilege would be relevant if the architect restricted which administrators could view stored card data.
- ✓
Data minimization
Why this is correct
Data minimization means collecting and retaining only the data necessary for a specific purpose. Not storing the CVV after authorization reduces the amount of sensitive data at risk and aligns with the principle of limiting data retention to what is needed. This directly matches the architect's recommendation to avoid storing a sensitive element once it is no longer required.
- ✗
Separation of duties
Why it's wrong here
Separation of duties divides critical tasks among multiple people to prevent fraud or error. The scenario does not describe dividing responsibilities; it describes avoiding retention of a sensitive data element. Separation of duties would apply if the architect required two people to approve a payment or if development and production deployment were handled by different teams.
- ✗
Defense in depth
Why it's wrong here
Defense in depth uses multiple layers of controls so that if one fails, others still protect the asset. Not storing CVV is a single data handling decision, not a layered control strategy. Defense in depth might include encryption, access controls, and network segmentation, but the specific recommendation to avoid storing CVV is better described as data minimization.
Go deeper
Related to this question
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
Key term
Separation of duties
Separation of duties is a security principle that splits critical tasks and privileges among multiple people to prevent fraud, errors, and abuse of power.
About these practice questions
One of 989 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.