Least Privilege Principle: How Access Reviews Enforce Minimal Permissions
A security architect is designing a system where user access rights are reviewed and certified on a regular basis by data owners. The goal is to ensure that users continue to have only the permissions necessary to perform their job functions and that no excessive permissions exist. Which security principle is primarily being implemented through these regular reviews?
Quick Answer
The correct answer is the principle of least privilege. This is because regular access reviews directly enforce minimal permissions by requiring data owners to periodically certify that each user’s access rights align strictly with their current job functions, removing any excessive permissions that may have accumulated over time. On the Microsoft SC-900 exam, this concept tests your understanding of how identity governance tools like Azure AD access reviews operationalize the least privilege principle to reduce the attack surface. A common trap is confusing least privilege with segregation of duties or role-based access control—remember that least privilege is the *goal* of minimizing permissions, while access reviews are the *mechanism* that verifies it. Memory tip: think “certify to clarify”—if a data owner must certify access, they are enforcing the least privilege principle by clarifying what is truly needed.
⚠ Common exam trap
Many exam-takers confuse the periodic review of permissions with the zero trust model, but zero trust focuses on continuous verification at each access request rather than periodic certification of existing rights.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Least privilege
Regular access reviews directly enforce the principle of least privilege by ensuring users retain only the permissions necessary for their current job functions. This process identifies and removes excessive permissions that may have accumulated over time, aligning with the core goal of minimizing the attack surface. In Microsoft 365, this is often implemented through Azure AD access reviews, where data owners certify or revoke user access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Defense in depth
Why it's wrong here
Defense in depth is a strategy using multiple layers of security controls (e.g., firewalls, encryption). Regular access reviews do not directly implement this principle.
When this WOULD be correct
A question asks: 'An organization implements multiple security controls at different layers (network, endpoint, application) to protect against threats. Which principle is being applied?' Then defense in depth would be correct.
- ✗
Zero trust
Why it's wrong here
Zero trust is a security model that assumes no implicit trust and continuously verifies every access request. While access reviews support zero trust, the specific focus on ensuring minimal permissions aligns more directly with least privilege.
When this WOULD be correct
A question describing a network architecture where every access request is authenticated and authorized regardless of origin, such as 'An organization implements micro-segmentation and continuous verification for all network traffic. Which security principle is being applied?'
- ✓
Least privilege
Why this is correct
Least privilege means granting users the minimum level of access required. Regular access reviews are a key governance practice to uphold least privilege by detecting and removing excessive permissions.
- ✗
Separation of duties
Why it's wrong here
Separation of duties divides critical tasks among multiple users to prevent fraud or error. Access reviews focus on individual permissions, not task division.
When this WOULD be correct
An exam question asks: 'Which security principle ensures that no single individual has the authority to both approve and process a financial transaction, thereby reducing the risk of fraud?' In that context, separation of duties is the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Least privilegeCorrect answer▾
Why this is correct
Least privilege means granting users the minimum level of access required. Regular access reviews are a key governance practice to uphold least privilege by detecting and removing excessive permissions.
✗Defense in depthWrong answer — click to see why▾
Why this is wrong here
Defense in depth is a layered security strategy using multiple controls (e.g., firewalls, antivirus, encryption) to protect assets, not specifically about reviewing and certifying user permissions to enforce minimal access.
★ When this WOULD be the correct answer
A question asks: 'An organization implements multiple security controls at different layers (network, endpoint, application) to protect against threats. Which principle is being applied?' Then defense in depth would be correct.
Why candidates choose this
Candidates may confuse 'regular reviews' as part of a comprehensive security posture, mistakenly associating the layered approach of defense in depth with the periodic review process.
✗Zero trustWrong answer — click to see why▾
Why this is wrong here
Zero trust is a security model that assumes no implicit trust and continuously verifies every access request, but the question specifically focuses on regular reviews and certifications to enforce minimal permissions, which is the principle of least privilege.
★ When this WOULD be the correct answer
A question describing a network architecture where every access request is authenticated and authorized regardless of origin, such as 'An organization implements micro-segmentation and continuous verification for all network traffic. Which security principle is being applied?'
Why candidates choose this
Candidates may confuse zero trust with least privilege because both involve restricting access, but zero trust is broader and includes continuous verification, while least privilege specifically limits permissions to the minimum necessary.
✗Separation of dutiesWrong answer — click to see why▾
Why this is wrong here
Separation of duties prevents fraud by requiring multiple people to complete a sensitive task, but it does not directly address the regular review and certification of user permissions to remove excessive access, which is the core of least privilege.
★ When this WOULD be the correct answer
An exam question asks: 'Which security principle ensures that no single individual has the authority to both approve and process a financial transaction, thereby reducing the risk of fraud?' In that context, separation of duties is the correct answer.
Why candidates choose this
Candidates may confuse separation of duties with least privilege because both involve controlling access, but separation of duties focuses on dividing tasks among multiple users, not on minimizing permissions per user.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SC-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company configures its access control system so that each user can only access the data and perform actions that are strictly necessary for their job role. This configuration is a direct implementation of which security principle?
easy- A.Defense in depth
- ✓ B.Least privilege
- C.Separation of duties
- D.Zero Trust
Why B: The configuration described—granting each user only the access and actions strictly necessary for their job role—is the direct definition of the least privilege principle. In Microsoft identity and access management, this is implemented by assigning the minimum required permissions via Azure RBAC roles (e.g., Reader instead of Contributor) or using Azure AD Privileged Identity Management (PIM) for just-in-time access. This minimizes the attack surface by ensuring users cannot exceed their authorized scope.
Variation 2. A company configures its identity and access management system so that employees are granted only the permissions necessary to perform their job functions. For example, a sales representative has read-only access to the customer database and cannot modify financial records. Which security principle is being applied in this scenario?
easy- A.Segregation of duties
- B.Defense in depth
- ✓ C.Least privilege
- D.Zero Trust
Why C: The scenario describes granting employees only the permissions necessary to perform their job functions, which is the core definition of the least privilege principle. In Microsoft identity and access management, this is implemented by assigning the minimum required Azure RBAC roles or Microsoft Entra ID directory roles, ensuring users have no more access than needed. This directly reduces the attack surface and limits potential damage from compromised accounts.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.