SSCP Access Controls Practice Question
A security analyst notices that a service account has been granted domain administrator privileges. Which principle of access control is being violated?
⚠ Common exam trap
SSCP often tests the distinction between least privilege and need-to-know, causing candidates to choose need-to-know when the issue is excessive permissions rather than information access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Least privilege
Granting a service account domain administrator privileges violates the principle of least privilege, which states that accounts should have only the minimum permissions necessary to perform their required tasks. A service account typically needs limited, specific permissions, not full domain admin rights. This over-provisioning increases the attack surface and risk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Need-to-know
Why it's wrong here
Need-to-know restricts access to information required for a specific task; it governs data access scope, not the breadth of administrative rights. It would be the answer if the account could read unrelated sensitive records, rather than holding excessive domain-wide privileges.
- ✗
Separation of duties
Why it's wrong here
Separation of duties divides critical tasks among different people to prevent fraud; it concerns splitting functions, not limiting a single account's privilege level. It would apply where one person controls an entire transaction end to end, which is not the scenario described.
- ✓
Least privilege
Why this is correct
Least privilege requires granting only the access needed to perform a role's duties. A service account holding domain administrator rights far exceeds its operational requirements, so the excessive privilege violates that principle, regardless of authentication or separation-of-duties controls.
- ✗
Accountability
Why it's wrong here
Accountability concerns tracing actions to a named individual, not limiting the privileges granted to an account. Excessive privilege violates least privilege. Accountability would be the answer if the question asked how to attribute an action to a specific user after the fact.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.