hardMultiple SelectObjective-mapped
Understanding the Principles of Least Privilege
A security administrator is tasked with managing user access. Which THREE of the following are principles of least privilege? (Choose three.)
Quick Answer
Removing access when it's no longer required is a core principle of least privilege because least privilege isn't a one-time grant decision, it's an ongoing discipline of keeping every user's permissions matched to their current, actual job needs, and that match constantly drifts as people change roles, finish projects, or leave the organization. Access that was appropriate six months ago can become excessive today if a person's responsibilities have narrowed, and if nobody actively revokes the permissions they no longer need, the organization accumulates exactly the kind of unnecessary standing access that least privilege is meant to prevent. This is what separates least privilege from a static, set-it-and-forget-it access grant: it requires periodic review and deliberate removal, not just careful thinking at the moment access is first provisioned. Frameworks like role-based access control and attribute-based access control provide the mechanisms for assigning access according to role or context, but least privilege is the underlying policy goal those mechanisms are enforcing, minimizing the attack surface and limiting the damage any single compromised account or insider can do. When a question lists candidate least privilege principles, favor answers describing minimal necessary access, time-limited or need-based grants, and proactive removal of unused or outdated access over answers describing broad, convenience-based, or permanent grants.
⚠ Common exam trap
Candidates often confuse security principles (like least privilege) with security mechanisms (like MAC) or administrative processes (like approval workflows), leading them to select options that are related but not direct statements of the principle itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Grant users the minimum rights needed to perform their job.
The principle of least privilege dictates that users should be granted only the minimum permissions necessary to perform their job functions. This minimizes the attack surface and limits potential damage from accidental or malicious actions. It is a foundational access control concept enforced through role-based access control (RBAC) or attribute-based access control (ABAC) policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement mandatory access control.
Why it's wrong here
MAC is a model, not a principle of least privilege.
- ✗
Require manager approval for privilege escalation.
Why it's wrong here
Approval is a complementary control, not a principle.
- ✓
Grant users the minimum rights needed to perform their job.
Why this is correct
This is the core of least privilege.
- ✓
Use separate accounts for administrative tasks.
Why this is correct
Separate admin accounts reduce risk of privilege misuse.
- ✓
Remove access when no longer required.
Why this is correct
Continuous review and removal of unnecessary access is key.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 920-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SSCP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security analyst is reviewing the access control policy and notices that some users have been granted 'write' access to a directory that contains sensitive financial reports. Which principle of information security is being violated?
easy- A.Non-repudiation
- ✓ B.Least privilege
- C.Availability
- D.Confidentiality
Why B: The principle of least privilege dictates that users should be granted only the minimum permissions necessary to perform their job functions. Granting 'write' access to a directory containing sensitive financial reports to users who do not require that level of access violates this principle, as it introduces unnecessary risk of unauthorized modification or data leakage.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.