CISSP - Security Operations (13% of the exam) - Section 7.4

Apply foundational security operations concepts such as need-to-know, least privilege, separation of duties, privileged account management, and job rotation.

Apply foundational security operations concepts - need-to-know, least privilege, separation of duties, privileged account management, and job rotation - to reduce insider threat and limit the blast radius of compromised accounts. Identify which concept is violated in a given access control scenario and recommend the corrective control.

need-to-knowleast privilegeseparation of dutiesprivileged account managementjob rotation

Practice question for this objective

Free sampleSecurity Operationsmedium

A risk manager is reviewing a privileged account management programme and notices that database administrators use shared root accounts to perform routine maintenance. Which improvement BEST aligns with foundational security operations principles for privileged accounts?

AIncrease password length on the shared root accounts and rotate the credentials weekly so that exposure windows are reduced for the administrative team.
BRequire administrators to log database maintenance activities in a shared spreadsheet at the end of each shift so that management can review changes the following day.
CIssue each administrator a named privileged account that is checked out through a vault for elevated sessions and audited per individual, with the shared root retired or broken-glass only. Correct
DMove all database administration into a single change advisory board meeting that approves maintenance windows in advance for the team as a group.

Recognise that privileged account management requires individually attributable elevated identities, vaulted credentials, and reserved break-glass access rather than routine shared root use. Effective privileged account management is built on the principles of individual accountability, least privilege, and auditability. Shared root accounts violate all three because actions cannot be attributed to a specific person. Brokering access through a vault that issues or checks out credentials to named users and records the session restores accountability, while a sealed break-glass account remains available for genuine emergencies.

Why A is wrong: Stronger and shorter-lived shared credentials reduce some exposure, but shared accounts still break individual accountability and make forensic attribution of any administrative action impossible. The fundamental flaw of shared root use is not solved by password hygiene alone.

Why B is wrong: Self-reported activity logs are not a substitute for system-enforced privileged session controls. They are easily falsified, do not prevent misuse, and do not address the underlying lack of accountability that shared root use creates.

Why C is correct: Privileged account management best practice is to provide individually attributable elevated identities, broker access through a credential vault with session recording, and reserve true shared root accounts for emergency break-glass use. This preserves accountability, supports least privilege, and provides a defensible audit trail.

Why D is wrong: Change advisory governance is valuable for scheduling and risk acceptance but does not address how the administrators authenticate, what privileges they wield in the session, or how their individual actions are recorded. The shared root problem persists regardless of how the maintenance window is approved.

See more CISSP practice questions, answers explained.

Exam traps in Security Operations

Answers that look right on this material and are not. Each one is a distractor from a different question in the CISSP bank for this domain.

Need-to-know is enforced by role-based access control mechanisms, whereas least privilege is enforced exclusively by mandatory access control labelling.
Why it is wrong: Both principles can be enforced through a range of access control models including discretionary, role-based, and mandatory schemes. Tying each principle to a single enforcement model misrepresents how access control implementations actually combine them.
Enable full-disk encryption on the existing laptop and brief the director on connecting only through the corporate VPN while abroad.
Why it is wrong: Full-disk encryption and VPN use are sensible baseline controls, but they do not address the core risk that the device itself may be seized, cloned, or implanted with hardware or firmware compromises at a border crossing or hotel; a manager-led travel-security programme would not stop at encryption alone.

Examworthy is not affiliated with or endorsed by ISC2. Original, blueprint-aligned practice material only.