The answer is regular permission reviews and role-based access control. Regular permission reviews are essential because they ensure that user access rights are continuously aligned with current job responsibilities, preventing the accumulation of excessive privileges that violate least privilege over time. Role-based access control (RBAC) supports this by assigning permissions based on defined organizational roles rather than individual users, making it easier to enforce the principle from the start. On the ISC2 Certified in Cybersecurity CC exam, this concept tests your understanding of NIST SP 800-53 AC-6, which mandates periodic access audits. A common trap is assuming least privilege is a one-time setup; in reality, it requires ongoing maintenance as roles change. A helpful memory tip is “Review roles, reduce risks”—regularly reviewing roles and permissions is the key to sustaining least privilege.
ISC2 CC Access Controls Concepts Practice Question
This CC practice question tests your understanding of access controls concepts. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
An organization is implementing a new access control system based on the principle of least privilege. Which two of the following practices are essential to achieving least privilege? (Select TWO)
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "least"
Why it matters: You want the option with minimum overhead, fewest steps, or lowest impact — not the most feature-rich or comprehensive answer.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Review permissions regularly
Option A is correct because regular permission reviews are essential to maintaining least privilege over time. Users' roles and responsibilities change, and without periodic audits, excessive permissions can accumulate, violating the principle. This aligns with the NIST SP 800-53 AC-6 control for least privilege, which requires organizations to review user access rights at defined intervals.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Review permissions regularly
Why this is correct
Regular reviews help maintain minimal permissions by revoking unnecessary access.
Clue confirmation
The clue word "least" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✓
Use role-based access control
Why this is correct
RBAC assigns permissions based on job roles, aligning with least privilege.
Clue confirmation
The clue word "least" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Grant users default full access and restrict later
Why it's wrong here
This approach gives excessive initial access, violating least privilege.
✗
Enable accounts after use
Why it's wrong here
Enabling accounts is not directly related to least privilege; disabling inactive accounts is more relevant.
✗
Provide write access to all users
Why it's wrong here
Granting write access to all users is excessive and violates least privilege.
Common exam traps
Common exam trap: answer the scenario, not the keyword
ISC2 often tests that candidates confuse the principle of least privilege with account management practices like enabling/disabling accounts, or mistakenly think starting with full access and restricting later is acceptable, when in fact least privilege requires a default-deny posture.
Detailed technical explanation
How to think about this question
Role-based access control (RBAC) is a common implementation of least privilege, where permissions are assigned to roles rather than individuals, and users are assigned to roles based on their job functions. Under the hood, RBAC systems like Microsoft Active Directory or AWS IAM use policy evaluation engines that check each access request against the effective permissions derived from role assignments. A subtle behavior is that transitive role memberships (e.g., nested groups) can inadvertently grant broader access than intended, making regular reviews critical.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A security analyst at a medium-sized enterprise encounters this scenario during an investigation or architecture review. The correct answer reflects best practice for the specific threat or control described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Security exam questions test whether you can match controls to threats in context — not just recall definitions.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this CC question in full detail.
Access Controls Concepts — This question tests Access Controls Concepts — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Review permissions regularly — Option A is correct because regular permission reviews are essential to maintaining least privilege over time. Users' roles and responsibilities change, and without periodic audits, excessive permissions can accumulate, violating the principle. This aligns with the NIST SP 800-53 AC-6 control for least privilege, which requires organizations to review user access rights at defined intervals.
What should I do if I get this CC question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "least". You want the option with minimum overhead, fewest steps, or lowest impact — not the most feature-rich or comprehensive answer.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.