mediumMultiple ChoiceObjective-mapped
CISSP Practice Question: Describes the concept of 'least privilege' in the…
Which of the following describes the concept of 'least privilege' in the context of access control?
⚠ Common exam trap
It's easy for candidates to confuse 'least privilege' with 'need-to-know' (which focuses on data confidentiality rather than permission granularity) or assume that role-based access inherently enforces least privilege, ignoring that roles can be overly broad.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Users are granted only the permissions necessary to perform their job functions
Least privilege is a fundamental access control principle that mandates users be granted only the permissions necessary to perform their specific job functions. This minimizes the attack surface by reducing unnecessary access to sensitive resources, limiting potential damage from accidental or malicious actions. In practice, this is enforced through mechanisms like discretionary access control (DAC) or role-based access control (RBAC) with granular permission sets, ensuring no user has more rights than required.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Users are granted only the permissions necessary to perform their job functions
Why this is correct
The principle of least privilege dictates that users, processes, and applications should be granted only the absolute minimum set of permissions required to perform their legitimate functions. This minimizes the potential damage from accidental errors, insider threats, or external attacks, as a compromised entity will have limited capabilities within the system. It's a foundational security concept that reduces the overall attack surface and limits the blast radius of any security incident.
- ✗
Access is granted on a need-to-know basis but with maximum permissions
Why it's wrong here
While 'need-to-know' correctly limits access to only the information relevant to a user's task, pairing it with 'maximum permissions' fundamentally contradicts the principle of least privilege. Granting maximum permissions, such as full administrative control, even over a limited set of data, creates an unnecessary security risk. This approach fails to restrict the *level* of access to the minimum required, thereby increasing the potential impact of a compromise within that specific data scope.
- ✗
Access is based on roles and seniority
Why it's wrong here
Access based on roles and seniority, while a common method for managing permissions, does not inherently enforce least privilege. Role-Based Access Control (RBAC) often assigns a collection of permissions to a role, and a user assigned to that role might receive more permissions than strictly necessary for a particular task or even their overall job function. Seniority, by itself, is not a security principle and does not dictate the specific technical permissions required for operational duties, potentially leading to over-privileging.
- ✗
Users have access to all resources unless explicitly denied
Why it's wrong here
This statement describes a 'default permit' or 'implicit allow' security policy, where all access is granted unless explicitly configured otherwise. Such a policy is inherently insecure and directly opposes the principle of least privilege and secure system design. It creates an enormous attack surface, as any unconfigured or overlooked resource becomes accessible by default, making it extremely difficult to maintain a strong security posture and manage access effectively.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Identity and Access Management (IAM)
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
Key term
RBAC
RBAC is a method of restricting network access based on the roles of individual users within an organization, where permissions are assigned to roles rather than to individuals directly.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.