SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A company is implementing a new security policy that requires every user to have only the minimum permissions necessary to perform their job duties. Which security principle does this policy align with?
⚠ Common exam trap
Many candidates confuse the Principle of Least Privilege with Zero Trust, but Zero Trust is a broader framework that includes least privilege as one of its core pillars, not the specific policy of minimizing permissions per user.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Principle of least privilege
The policy requiring every user to have only the minimum permissions necessary to perform their job duties directly aligns with the Principle of Least Privilege. This principle dictates that users, applications, and systems should be granted the minimal level of access rights needed to complete their tasks, reducing the attack surface and limiting potential damage from compromised accounts. In Microsoft 365, this is implemented through Role-Based Access Control (RBAC) roles and Azure AD roles, where administrators assign specific permissions rather than broad administrative roles.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Defense in depth
Why it's wrong here
Defense in depth is a cybersecurity strategy that employs multiple, independent layers of security controls to protect assets and data. This approach ensures that if one security control fails or is bypassed, other controls are still in place to prevent or detect an attack. While crucial for overall resilience, it focuses on the breadth and layering of security mechanisms, rather than the specific granularity of permissions granted to individual users for their daily tasks.
- ✗
Zero Trust
Why it's wrong here
The Zero Trust security model operates on the principle of "never trust, always verify," requiring explicit verification for every access request, regardless of whether the request originates inside or outside the network perimeter. It encompasses identity, device, data, network, and application workloads, continuously evaluating context before granting access. While it often incorporates least privilege, Zero Trust is a comprehensive architectural strategy for securing an entire enterprise, not solely a policy for minimum user permissions.
- ✓
Principle of least privilege
Why this is correct
The Principle of Least Privilege dictates that users, applications, and systems should be granted only the minimum necessary permissions required to perform their specific job functions or tasks. This fundamental security practice significantly reduces the attack surface by limiting the potential damage an attacker can inflict if an account is compromised or an application is exploited. It directly addresses the need to restrict access to only what is absolutely essential, minimizing unauthorized actions.
- ✗
Separation of duties
Why it's wrong here
Separation of duties is an internal control mechanism designed to prevent fraud, error, and abuse by distributing critical tasks and responsibilities among multiple individuals. This ensures that no single person has complete control over a sensitive process from start to finish, requiring collusion for malicious activity. While it limits the scope of control for any one individual, it does not inherently dictate the minimum level of permission each individual receives for their assigned portion of the task.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.