SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A company implements a policy where each employee is granted only the permissions necessary to perform their specific job role. For example, a marketing specialist has read-only access to the customer database and cannot modify financial records. Which security principle is primarily being applied?
⚠ Common exam trap
A common mix-up: candidates confuse 'least privilege' with 'separation of duties' because both involve limiting permissions, but separation of duties focuses on splitting critical tasks across multiple users to prevent fraud, whereas least privilege restricts each user to the minimum permissions for their single role.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Least privilege
The principle of least privilege dictates that users should be granted only the permissions necessary to perform their job functions. In this scenario, the marketing specialist receives read-only access to the customer database and no access to financial records, which directly aligns with limiting permissions to the minimum required. This reduces the attack surface and limits potential damage from accidental or malicious actions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Defense in depth
Why it's wrong here
Defense in depth is a cybersecurity strategy that employs multiple layers of security controls to protect information and assets. This approach ensures that if one security control fails or is bypassed, other controls are in place to prevent or detect an intrusion. While crucial for overall security posture, it focuses on the stacking of diverse security mechanisms (e.g., firewalls, MFA, encryption) rather than the specific policy of granting minimum necessary permissions based on an individual's job role.
- ✓
Least privilege
Why this is correct
Least privilege is a fundamental security principle dictating that users, programs, or processes should be granted only the minimum necessary access rights or permissions required to perform their specific job function or task. This directly aligns with the scenario where an employee's access is restricted precisely to what they need for their role, minimizing the potential impact if their account is compromised or misused. Implementing least privilege significantly reduces the attack surface and the blast radius of security incidents.
- ✗
Zero Trust
Why it's wrong here
Zero Trust is a comprehensive security model that operates on the principle "never trust, always verify," assuming no implicit trust is granted to any user or device, regardless of whether they are inside or outside the network perimeter. It continuously authenticates and authorizes every access request based on identity, device health, and other contextual factors. While Zero Trust architectures incorporate least privilege, the question specifically describes the outcome of limiting permissions based on role, rather than the continuous verification and dynamic policy enforcement characteristic of the broader Zero Trust model.
- ✗
Separation of duties
Why it's wrong here
Separation of duties is an internal control mechanism designed to prevent fraud, error, or misuse by ensuring that no single individual has complete control over a critical business process or transaction. It involves dividing key responsibilities and tasks among multiple individuals, such as requiring different people to initiate, approve, and record financial transactions. This principle focuses on distributing responsibilities across roles to prevent conflicts of interest, rather than defining the granular access permissions granted to a single employee for their daily operational tasks.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.