easyMultiple Choice
ISC2 CC Practice Question: A system administrator must grant a help desk…
A system administrator must grant a help desk technician the ability to reset user passwords but not change user roles. Which security principle does this scenario enforce?
⚠ Common exam trap
Many candidates confuse least privilege (limiting what actions a user can perform) with need-to-know (limiting what data a user can access) — both sound similar but apply to different dimensions of access control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Principle of least privilege
The principle of least privilege dictates that users are granted only the minimum access rights necessary to perform their job functions — no more. Granting the help desk technician the ability to reset passwords but explicitly withholding the ability to change user roles is a textbook application of this principle, because role changes are a more privileged operation than password resets. This limits the blast radius if the technician's account is compromised.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Accountability
Why it's wrong here
Accountability is the principle that actions are traceable to an identity through logging and audit, which password reset permissions do not enforce. It is tempting because help desk roles are audited, but least privilege is the principle that grants only the reset capability while withholding role-change rights.
- ✓
Principle of least privilege
Why this is correct
Granting only password-reset rights, while withholding role-assignment permissions, enforces least privilege: each identity receives the minimum access needed for its tasks. Microsoft Entra ID supports this through scoped administrative roles such as Password Administrator, which cannot modify role memberships, satisfying the stem's constraint that role changes remain blocked.
- ✗
Need-to-know
Why it's wrong here
Need-to-know governs access to specific data based on relevance to a task, not which actions a role may perform. It is tempting because help desk staff access user accounts, but the scenario restricts permitted operations, which is least privilege, not data relevance.
- ✗
Non-repudiation
Why it's wrong here
Non-repudiation proves a party performed an action, typically via digital signatures or audit logs, so it cannot address restricting a technician's permissions. It is tempting because logging password resets supports accountability, but the scenario enforces least privilege by limiting the technician to password resets only.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Key term
RADIUS
RADIUS is a network protocol that provides centralized authentication, authorization, and accounting management for users who connect and use a network service.
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
About these practice questions
One of 989 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.