Exam SSCP topic 1 question 32 discussion

Actual exam question from ISC's SSCP

Question #: 32
Topic #: 1

[All SSCP Questions]

The end result of implementing the principle of least privilege means which of the following?

A. Users would get access to only the info for which they have a need to know
B. Users can access all systems.
C. Users get new privileges added when they change positions.
D. Authorization creep.

Show Suggested Answer

Suggested Answer: A 🗳️
The principle of least privilege refers to allowing users to have only the access they need and not anything more. Thus, certain users may have no need to access any of the files on specific systems.
The following answers are incorrect:
Users can access all systems. Although the principle of least privilege limits what access and systems users have authorization to, not all users would have a need to know to access all of the systems. The best answer is still Users would get access to only the info for which they have a need to know as some of the users may not have a need to access a system.
Users get new privileges when they change positions. Although true that a user may indeed require new privileges, this is not a given fact and in actuality a user may require less privileges for a new position. The principle of least privilege would require that the rights required for the position be closely evaluated and where possible rights revoked.
Authorization creep. Authorization creep occurs when users are given additional rights with new positions and responsibilities. The principle of least privilege should actually prevent authorization creep.
The following reference(s) were/was used to create this question:

ISC2 OIG 2007 p.101,123 -
Shon Harris AIO v3 p148, 902-903

by xymavu at April 4, 2025, 10:51 p.m.

Comments

Submit Cancel

Currently there are no comments in this discussion, be the first to comment!