CISSP Identity and Access Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Need-to-know

  Why it's wrong here

  The 'need-to-know' principle dictates that access to specific information or data is granted only when an individual's job function absolutely requires it for their duties. It primarily focuses on restricting access to sensitive information to maintain confidentiality and prevent unauthorized disclosure, rather than governing the scope of operational permissions or system capabilities a user can execute. While related to access control, it is distinct from limiting the actual privileges to perform actions.

• ✓

  Least privilege

  Why this is correct

  The principle of least privilege mandates that users, programs, or processes are granted only the absolute minimum set of permissions or access rights required to perform their legitimate tasks and nothing more. This fundamental security practice minimizes the attack surface by reducing the potential damage from accidental errors, insider threats, or successful external attacks, as compromised accounts have severely limited capabilities. It directly ensures a user is granted only the necessary permissions.

• ✗

  Separation of duties

  Why it's wrong here

  Separation of duties (SoD) is a control mechanism designed to prevent fraud, error, and abuse by requiring that no single individual has complete control over a critical or sensitive process from start to finish. It divides tasks that, if combined, could lead to a conflict of interest or potential compromise, among multiple individuals. This principle focuses on process integrity and accountability across multiple roles, not on the granular permissions granted to a single user.

• ✗

  Zero standing privileges

  Why it's wrong here

  Zero standing privileges (ZSP) is an advanced security concept where no user or system account possesses permanent administrative or elevated access rights. Instead, privileges are granted just-in-time (JIT) and for a limited duration only when explicitly requested, approved, and needed for a specific task. While ZSP is a highly effective method for managing and reducing the risk associated with privileged accounts, it is a *strategy* for implementing privilege management, not the fundamental *principle* that ensures a user is granted *only* the necessary permissions in the first place.

Go deeper

Related to this question