The answer is need to know. This access control concept prevents the help desk technician from knowing the new password because, while the technician must perform the password reset, they do not require the actual password value to complete their job function. The need-to-know principle restricts access to information strictly on the basis of whether that information is necessary for a specific task, not merely on the user’s role or permission level. On the ISC2 Certified in Cybersecurity CC exam, this question tests your ability to distinguish need to know from least privilege, which is a common trap: least privilege limits the technician’s permissions to the minimum necessary to reset the password, but it does not inherently block them from seeing the new password if they have the reset capability. A helpful memory tip is to think of the phrase “need to know, not just need to do”—the technician needs to do the reset, but does not need to know the result.
ISC2 CC Access Controls Concepts Practice Question
This CC practice question tests your understanding of access controls concepts. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A help desk technician needs to reset a user's password, but the security policy requires that the technician does not know the new password. Which access control concept prevents the technician from knowing the password?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Need to know
The 'need to know' concept restricts access to information based on whether the user requires that information to perform their job functions. In this scenario, the technician must reset the password but does not need to know the new password itself, so the policy enforces that the technician cannot view or retain the new password. This is distinct from least privilege, which limits permissions to the minimum necessary, but does not inherently prevent knowledge of the password if the technician has the reset permission.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Discretionary access control (DAC)
Why it's wrong here
DAC allows resource owners to control access; it does not address password knowledge.
✓
Need to know
Why this is correct
Need to know ensures users only access information required for their job tasks.
Related concept
Read the scenario before looking for a memorised answer.
✗
Least privilege
Why it's wrong here
Least privilege restricts permissions, not knowledge of information.
✗
Separation of duties
Why it's wrong here
Separation of duties requires multiple people for sensitive tasks, but does not directly address knowledge of passwords.
Common exam traps
Common exam trap: answer the scenario, not the keyword
ISC2 often tests the distinction between 'least privilege' and 'need to know' by presenting a scenario where a user has permissions but should not know the data, leading candidates to mistakenly choose least privilege because it sounds similar, when 'need to know' specifically addresses knowledge of the information itself.
Detailed technical explanation
How to think about this question
In practice, 'need to know' is often enforced through access control lists (ACLs) or attribute-based access control (ABAC) policies that restrict read or view permissions on sensitive attributes like password hashes or plaintext values. For example, in Active Directory, a help desk account may have 'Reset Password' permission but not 'Read Password' permission, ensuring the technician can trigger a password change without ever seeing the new value. This aligns with the principle of data confidentiality, where knowledge of the password is a separate privilege from the ability to modify it.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A security analyst at a medium-sized enterprise encounters this scenario during an investigation or architecture review. The correct answer reflects best practice for the specific threat or control described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Security exam questions test whether you can match controls to threats in context — not just recall definitions.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this CC question in full detail.
Access Controls Concepts — This question tests Access Controls Concepts — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Need to know — The 'need to know' concept restricts access to information based on whether the user requires that information to perform their job functions. In this scenario, the technician must reset the password but does not need to know the new password itself, so the policy enforces that the technician cannot view or retain the new password. This is distinct from least privilege, which limits permissions to the minimum necessary, but does not inherently prevent knowledge of the password if the technician has the reset permission.
What should I do if I get this CC question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.