ISC2 CC Access Controls Concepts Practice Question
Which principle ensures that users are granted only the minimum permissions necessary to perform their job functions?
⚠ Common exam trap
The CC exam often tests the confusion between least privilege and need-to-know — both minimize access, but least privilege is about permissions/rights while need-to-know is about information access based on a specific requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Least privilege
The principle of least privilege states that users (and processes) should be granted only the minimum permissions necessary to perform their job functions, reducing the attack surface and limiting the blast radius of a compromised account. It is a foundational access-control principle in cybersecurity and is explicitly tested in the ISC2 CC exam. Defense in depth, separation of duties, and need-to-know are related but distinct concepts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Defense in depth
Why it's wrong here
Defense in depth layers multiple independent controls so no single failure exposes the system; it does not limit each user's permissions. Least privilege is the principle that grants only the minimum access needed. Defense in depth would be correct when designing overlapping controls such as firewalls, MFA and endpoint protection.
- ✓
Least privilege
Why this is correct
Least privilege grants each user only the minimum permissions their job requires, limiting blast radius if credentials are compromised. It directly satisfies the stem's constraint of minimum necessary access, unlike broader models such as role-based or discretionary access.
- ✗
Separation of duties
Why it's wrong here
Separation of duties splits critical tasks across multiple people to prevent fraud, rather than restricting each user's permissions to the minimum. Least privilege governs permission scope. Separation of duties would be correct when, for example, the person approving payments must differ from the person creating them.
- ✗
Need-to-know
Why it's wrong here
Need-to-know restricts access to specific data based on relevance to a task, not the breadth of permissions granted. Least privilege is the principle limiting permissions to the minimum required for a job function. Need-to-know is tempting because it also limits access, and would be correct when compartmentalising classified information by project.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
Learn chapter
Access Control Fundamentals
Key term
Separation of duties
Separation of duties is a security principle that splits critical tasks and privileges among multiple people to prevent fraud, errors, and abuse of power.
Key term
Defense in depth
Defense in depth is a cybersecurity strategy that uses multiple layers of security controls to protect information and systems, so if one layer fails, another layer is already in place to stop the attack.
About these practice questions
One of 989 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.