N10-009 Question 249
Single answerAuthorization: Least privilege, Role-based access control, GeofencingA company has technicians in the United States, Canada, and Europe who remotely administer branch-office routers through a centralized management portal. An audit found that several help desk employees can modify firewall rules even though their job only requires viewing device status and restarting approved services. The security team also wants to reduce the chance of compromised accounts being used from outside the regions where employees normally work. Which solution BEST addresses these requirements?
- A
Create separate administrator and help desk roles in the portal, assign only the minimum permissions each job requires, and restrict logins based on approved geographic regions
- B
Place all support staff in a single network-admin group, require longer passwords, and block access only during non-business hours
- C
Allow all authenticated users to manage routers, but require manager approval before firewall changes are made
- D
Issue shared administrator accounts for each region and allow access only from company-owned devices
Show answer and explanation
Correct answer: A
Explanation
The best answer is to implement RBAC so users are grouped by job function, apply least privilege so each role has only the minimum permissions required, and use geofencing to limit access attempts to expected regions. In this scenario, help desk staff should not have firewall-rule modification rights if their responsibilities are limited to monitoring and basic service actions. This follows common security best practices such as the principle of least privilege and separation of duties, both widely referenced in security guidance from organizations such as NIST. Geofencing is also appropriate here because the company already knows the expected regions from which employees work, making it a practical compensating control against suspicious logins from other locations. Together, these controls address both the over-permission finding from the audit and the risk of unauthorized access from unexpected geographic areas.
- A. Correct.
Correct. This combines role-based access control (RBAC) with least privilege and geofencing. Creating distinct roles ensures help desk staff receive only the permissions needed for their duties, such as viewing status and restarting approved services, while administrative changes like firewall-rule modification remain limited to administrator roles. Restricting logins to approved geographic regions adds an authorization-related access control that helps reduce the risk of account misuse from unexpected locations.
- B. Incorrect.
Incorrect. A single network-admin group violates least-privilege principles because it gives excessive permissions to users who do not need them. Longer passwords improve authentication strength, but they do not solve the authorization issue identified in the audit. Blocking access during non-business hours is a time-based restriction, not a geographic control, so it does not meet the geofencing requirement.
- C. Incorrect.
Incorrect. Allowing all authenticated users to manage routers ignores RBAC and least privilege. Manager approval may add oversight, but it does not prevent excessive standing permissions. The key problem in the scenario is that help desk users already have more access than they should; this option keeps that over-permissive model in place.
- D. Incorrect.
Incorrect. Shared administrator accounts are a poor security practice because they reduce accountability and make auditing difficult. Although restricting access from company-owned devices can help with endpoint trust, it is not the same as geofencing and does not address the requirement to tailor permissions by job role. This option also fails least privilege by using broad administrator access.