SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A security analyst is explaining the concept of 'Least Privilege' to a new team member. Which statement best describes the principle of least privilege?
⚠ Common exam trap
Watch out — candidates often confuse 'least privilege' with 'default deny' (Option B), but least privilege is about granting the minimal necessary permissions after initial access, not disabling all permissions upfront.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Users should have only the permissions necessary to perform their job functions.
The principle of least privilege dictates that users should be granted only the minimum permissions necessary to complete their job functions. This reduces the attack surface and limits potential damage from accidental or malicious actions. In Microsoft 365, this is implemented through Role-Based Access Control (RBAC) and Azure AD roles, where permissions are scoped to specific administrative units or tasks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Users should have only the permissions necessary to perform their job functions.
Why this is correct
The principle of least privilege dictates that users, processes, and applications should be granted the minimum level of access required to perform their authorized tasks and nothing more. This minimizes the attack surface by restricting potential damage if an account is compromised, ensuring that users can only interact with the resources essential for their specific roles. It's a foundational security concept for reducing risk.
- ✗
Users should have all permissions disabled by default.
Why it's wrong here
While a "default-deny" security posture is a good practice, stating that all permissions should be disabled by default is an oversimplification and misrepresents the principle of least privilege. Least privilege involves granting specific, necessary permissions, not a complete denial of all access. A user with all permissions disabled would be unable to perform any job function, rendering the system unusable and failing to address the need for controlled, functional access.
- ✗
Users should be given administrator rights to ensure they can perform any task.
Why it's wrong here
Granting users administrator rights fundamentally violates the principle of least privilege because it provides excessive permissions far beyond what is typically necessary for most job functions. Administrator accounts possess broad system-wide control, which significantly increases the attack surface and the potential impact of a security breach. If such an account is compromised, an attacker gains extensive control, making this a high-risk practice contrary to robust security principles.
- ✗
Users should share one account with elevated privileges for their team.
Why it's wrong here
Sharing a single account, especially one with elevated privileges, directly contradicts the principle of least privilege and introduces significant security vulnerabilities. This practice eliminates individual accountability, making it impossible to audit specific user actions or identify who performed a particular task. Furthermore, it grants all users of that shared account the same, potentially excessive, level of access, thereby increasing the risk of unauthorized actions or misuse.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
RBAC
RBAC is a method of restricting network access based on the roles of individual users within an organization, where permissions are assigned to roles rather than to individuals directly.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.