Security Fundamentals Practice Question 7: Least Privilege Service Account
Security Fundamentals · Test 1 · question 7 of 10
A new reporting tool needs to run a nightly query that reads the sales table in the company database. It never writes data. An administrator is creating the database account the tool will use. Which grant follows the principle of least privilege?
Show answer and explanation
Answer:
NIST defines least privilege as restricting the access privileges of users, or of processes acting on their behalf, to the minimum necessary to accomplish assigned tasks. The tool's task is to read one table, so read-only access on that table is the minimum (B). If the tool or its credentials are ever compromised, an attacker can read sales data but cannot change it or reach anything else.
- A gives full control of the database to a process that only needs to read. This is the most common least-privilege failure: granting broad rights to avoid troubleshooting. - C grants write access for a hypothetical future need. Least privilege means granting permissions when they are actually required, not in advance. - D is read-only, but it covers every table rather than the one the tool uses, so a compromise would expose data unrelated to the report (such as HR or customer records).
Reference: NIST CSRC Glossary: least privilege