Courseiva
← CC
Full test
mediumMultiple ChoiceObjective-mapped

Least Privilege Principle Violation: Root SSH Access

Exhibit

Refer to the exhibit.

```
Oct 15 10:23:45 server sshd[1234]: Failed password for root from 192.168.1.100 port 22 ssh2
Oct 15 10:23:46 server sshd[1234]: Failed password for root from 192.168.1.100 port 22 ssh2
Oct 15 10:23:47 server sshd[1234]: Failed password for root from 192.168.1.100 port 22 ssh2
Oct 15 10:23:48 server sshd[1234]: Failed password for root from 192.168.1.100 port 22 ssh2
Oct 15 10:23:49 server sshd[1234]: Failed password for root from 192.168.1.100 port 22 ssh2
```

An analyst reviews the exhibit. Which security principle is being violated by allowing root login via SSH?

Quick Answer

The correct answer is least privilege, as allowing root login via SSH directly violates this principle by granting unrestricted administrative access without requiring any privilege escalation. In a properly hardened SSH configuration, root login should be disabled—typically by setting `PermitRootLogin no` in `/etc/ssh/sshd_config`—forcing administrators to log in as a regular user and then use `sudo` or `su` to elevate privileges only when necessary. This minimizes the attack surface and ensures all actions are auditable and tied to a specific user account. On the ISC2 Certified in Cybersecurity CC exam, this concept tests your understanding of access control fundamentals; a common trap is confusing least privilege with separation of duties or defense in depth. Remember the memory tip: “No root SSH—escalate to elevate.”

⚠ Common exam trap

ISC2 often tests the distinction between least privilege and defense in depth, where candidates mistakenly choose defense in depth because they think multiple security layers are involved, but the question specifically targets the principle of granting only the minimum necessary access.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Least privilege

Allowing root login via SSH violates the principle of least privilege because it grants unrestricted administrative access to the system, bypassing any need for privilege escalation. In a properly secured SSH configuration, root login should be disabled (e.g., `PermitRootLogin no` in `/etc/ssh/sshd_config`), forcing administrators to log in as a regular user and then use `sudo` or `su` to elevate privileges only when necessary. This minimizes the attack surface and ensures that actions are auditable and tied to a specific user account.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    Fail-safe

    Why it's wrong here

    Fail-safe is not relevant.

  • ✓

    Least privilege

    Why this is correct

    Correct. Root should not be allowed to log in directly.

  • ✗

    Defense in depth

    Why it's wrong here

    Defense in depth is about multiple layers, not this issue.

  • ✗

    Separation of duties

    Why it's wrong here

    Separation of duties is not directly related.

About these practice questions

One of 976 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

2 more ways this is tested on CC

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A security administrator notices that a user with standard privileges was able to modify a system file. Which security principle has been violated?

easy
  • A.Need to know
  • B.Defense in depth
  • ✓ C.Least privilege
  • D.Separation of duties

Why C: The principle of least privilege requires that users be granted only the permissions necessary to perform their job functions. A standard user modifying a system file indicates they have been assigned unnecessary administrative rights, violating this principle. This could occur if the user is a member of a group like Administrators or has been granted explicit write access to protected directories such as %SystemRoot%\System32.

Variation 2. A security analyst discovers that an organization's firewall rule set allows all inbound traffic on TCP port 443 from any source to a single web server. Additionally, the server has a known critical vulnerability in its TLS implementation. Which principle of security architecture is most directly violated by this configuration?

hard
  • ✓ A.Least privilege
  • B.Defense in depth
  • C.Separation of duties
  • D.Fail-safe defaults

Why A: Least privilege is the principle that users and systems should be granted only the minimum necessary permissions to perform their functions. In this scenario, allowing all inbound traffic on TCP 443 from any source to a single web server violates least privilege because it permits access from any IP address worldwide, when only specific sources (e.g., the organization's IP ranges) are needed. The additional vulnerability in TLS is irrelevant to the principle itself; the core issue is the overly permissive firewall rule. Options B, C, and D describe different principles that are not the most directly violated. Defense in depth would be about having multiple layers of security, separation of duties is about dividing responsibilities, and fail-safe defaults is about default-deny posture. Therefore, the most direct violation is least privilege.

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.