easyMultiple ChoiceObjective-mapped
CISSP Practice Question: During a security audit, an organization…
During a security audit, an organization discovers that several employees are sharing a single generic account to access a critical database. Which principle of security operations is being violated?
⚠ Common exam trap
It's easy for candidates to confuse the lack of individual accountability with the principle of least privilege, assuming that sharing a generic account automatically means excessive permissions, when the real violation is the inability to uniquely identify and trace user actions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Accountability
Accountability requires that each individual user be uniquely identified and their actions traceable. Sharing a generic account breaks this chain because the audit logs cannot attribute specific database operations (e.g., SELECT, UPDATE, DELETE) to a particular employee, making it impossible to hold anyone responsible for misuse or errors.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Accountability
Why this is correct
Accountability ensures that all actions performed within an information system can be uniquely traced back to the individual or entity responsible for them. When user accounts are shared, the ability to establish a definitive link between a specific action and a particular person is lost, thereby destroying the audit trail and making it impossible to hold individuals responsible for their activities. This directly undermines non-repudiation and the integrity of security logs, which are critical for incident response and compliance.
- ✗
Separation of duties
Why it's wrong here
Separation of duties is a control designed to mitigate the risk of fraud, error, or unauthorized activity by ensuring that no single individual has complete control over a critical process or asset. While account sharing might indirectly complicate the enforcement of separation of duties if a shared account possesses multiple conflicting privileges, the primary security principle violated is the inability to attribute actions to a unique individual, rather than the distribution of tasks themselves. The core issue is identity management, not the division of responsibilities.
- ✗
Defense in depth
Why it's wrong here
Defense in depth is a comprehensive security strategy that employs multiple, overlapping security controls to protect assets, creating layers of protection so that if one control fails, others are still in place. This includes administrative, technical, and physical safeguards working in concert. While robust access controls are a component of a defense-in-depth strategy, account sharing represents a specific failure within the identity and access management layer, rather than a fundamental flaw in the multi-layered approach itself.
- ✗
Least privilege
Why it's wrong here
The principle of least privilege dictates that users, programs, or processes should be granted only the minimum necessary access rights to perform their legitimate functions. While shared accounts often lead to users having more privileges than individually necessary, the fundamental problem with account sharing is the inability to uniquely identify and hold accountable the individual performing an action. The issue is primarily about user identity and attribution, not solely the scope of permissions granted to the account.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Accountability
Accountability is the security principle that ensures actions and identity are linked so that a person or system can be held responsible for their activities.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.