hardMultiple SelectObjective-mapped
ISC2 CC Practice Question: Which TWO of the following are best practices for…
Which TWO of the following are best practices for implementing the principle of least privilege?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign permissions based on the minimum necessary to perform job functions
Options B and E are correct. The principle of least privilege dictates that users should be granted only the permissions necessary to perform their job functions (B), and those permissions should be regularly reviewed and revoked when no longer needed (E). Granting all users full administrative rights (A) violates least privilege. Using a single shared administrative account (C) removes accountability and is not a least privilege practice. Removing default accounts (D) is a security best practice but does not directly implement least privilege.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Grant all users full administrative rights to reduce support calls
Why it's wrong here
This violates least privilege by giving excessive permissions.
- ✓
Assign permissions based on the minimum necessary to perform job functions
Why this is correct
This is the core of least privilege.
- ✗
Use a single shared administrative account for all IT staff
Why it's wrong here
Shared accounts prevent accountability and violate least privilege.
- ✗
Remove all default accounts from systems
Why it's wrong here
While good practice, it does not directly address the principle of least privilege.
- ✓
Regularly review and revoke unnecessary privileges
Why this is correct
Periodic audits ensure that privileges remain appropriate.
Go deeper
Related to this question
Learn chapter
Introduction to Security Principles
Key term
Accountability
Accountability is the security principle that ensures actions and identity are linked so that a person or system can be held responsible for their activities.
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
About these practice questions
One of 976 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.