easyMultiple ChoiceObjective-mapped
ISC2 CC Practice Question: Refer to the exhibit
Exhibit
iptables -P INPUT DROP iptables -A INPUT -p tcp --dport 22 -j ACCEPT
Refer to the exhibit. The security principle demonstrated by the default policy is:
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Least privilege
Correct: D - Least privilege. The default DROP policy denies all traffic by default, allowing only explicitly permitted services, which follows the principle of least privilege. Option A (Separation of duties) is about dividing responsibilities among multiple people. Option B (Defense in depth) is about multiple layers of security. Option C (Need to know) is about limiting access to information necessary for a job. None of these describes a default deny policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Separation of duties
Why it's wrong here
Separation of duties divides responsibilities among people.
- ✗
Defense in depth
Why it's wrong here
Defense in depth requires multiple layers, not just a default policy.
- ✗
Need to know
Why it's wrong here
Need to know restricts data access, not network access.
- ✓
Least privilege
Why this is correct
Default deny restricts access to only what is explicitly allowed, embodying least privilege.
Visual reference
Go deeper
Related to this question
Learn chapter
Introduction to Security Principles
Key term
Defense in depth
Defense in depth is a cybersecurity strategy that uses multiple layers of security controls to protect information and systems, so if one layer fails, another layer is already in place to stop the attack.
Key term
Need to know
Need to know is a security principle that restricts access to information or resources only to individuals who require that access to perform their job duties.
About these practice questions
Courseiva writes every CC question from scratch — 976 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.