Apply foundational security operations concepts such as need-to-know, least privilege, separation of duties, privileged account management, and job rotation

Apply foundational security operations concepts such as need-to-know, least privilege, separation of duties, privileged account management, and job rotation.

Apply foundational security operations concepts - need-to-know, least privilege, separation of duties, privileged account management, and job rotation - to reduce insider threat and limit the blast radius of compromised accounts. Identify which concept is violated in a given access control scenario and recommend the corrective control.

need-to-knowleast privilegeseparation of dutiesprivileged account managementjob rotation

Practice question for this objective

Free sampleSecurity Operationsmedium

A risk manager is reviewing a privileged account management programme and notices that database administrators use shared root accounts to perform routine maintenance. Which improvement BEST aligns with foundational security operations principles for privileged accounts?

AIncrease password length on the shared root accounts and rotate the credentials weekly so that exposure windows are reduced for the administrative team.
BRequire administrators to log database maintenance activities in a shared spreadsheet at the end of each shift so that management can review changes the following day.
CIssue each administrator a named privileged account that is checked out through a vault for elevated sessions and audited per individual, with the shared root retired or broken-glass only. Correct
DMove all database administration into a single change advisory board meeting that approves maintenance windows in advance for the team as a group.

Recognise that privileged account management requires individually attributable elevated identities, vaulted credentials, and reserved break-glass access rather than routine shared root use. Effective privileged account management is built on the principles of individual accountability, least privilege, and auditability. Shared root accounts violate all three because actions cannot be attributed to a specific person. Brokering access through a vault that issues or checks out credentials to named users and records the session restores accountability, while a sealed break-glass account remains available for genuine emergencies.

Why A is wrong: Stronger and shorter-lived shared credentials reduce some exposure, but shared accounts still break individual accountability and make forensic attribution of any administrative action impossible. The fundamental flaw of shared root use is not solved by password hygiene alone.

Why B is wrong: Self-reported activity logs are not a substitute for system-enforced privileged session controls. They are easily falsified, do not prevent misuse, and do not address the underlying lack of accountability that shared root use creates.

Why C is correct: Privileged account management best practice is to provide individually attributable elevated identities, broker access through a credential vault with session recording, and reserve true shared root accounts for emergency break-glass use. This preserves accountability, supports least privilege, and provides a defensible audit trail.

Why D is wrong: Change advisory governance is valuable for scheduling and risk acceptance but does not address how the administrators authenticate, what privileges they wield in the session, or how their individual actions are recorded. The shared root problem persists regardless of how the maintenance window is approved.

See more CISSP practice questions with worked answers.

Examworthy is not affiliated with or endorsed by (ISC)2. Original, blueprint-aligned practice material only.

Apply foundational security operations concepts such as need-to-know, least privilege, separation of duties, privileged account management, and job rotation.

Practice question for this objective

More in this domain