SY0-701 Question 141
Single answerLeast privilegeA company discovers that several help desk technicians have been using a shared domain administrator account to install software, reset user passwords, and troubleshoot workstation issues. During a recent phishing incident, one technician's credentials were stolen, and the attacker used the shared admin account to move laterally across multiple systems. Management wants to reduce the impact of future credential compromise while still allowing technicians to perform their daily support tasks efficiently. Which action BEST supports the principle of least privilege?
- A
Replace the shared domain administrator account with individual named accounts assigned only the specific permissions needed for help desk duties, and require separate elevated access only for approved administrative tasks
- B
Keep the shared domain administrator account, but require technicians to change the password at the end of every shift and store it in the team's password manager
- C
Add all help desk technicians to the local Administrators group on every workstation so they can resolve incidents without waiting for approval
- D
Create a second shared account for password resets and a third shared account for software installation so privileges are divided between tasks
Show answer and explanation
Correct answer: A
Explanation
The best answer is to eliminate shared privileged accounts for routine support work and assign individual accounts with only the permissions required for each technician's role. This directly implements least privilege and supports accountability, auditing, and containment of compromised credentials. In practice, organizations commonly combine least privilege with role-based access control (RBAC), separation of duties, and privileged access management so users operate with standard accounts and elevate only when necessary. This approach is consistent with widely accepted guidance such as NIST SP 800-53 access control principles, including least privilege and account management, as well as general administrative best practices that discourage shared privileged accounts except in tightly controlled edge cases.
- A. Correct.
This is correct because least privilege requires users to have only the minimum access necessary to perform their job functions. Giving each technician an individual account with only the permissions required for routine help desk work limits misuse, improves accountability, and reduces the blast radius if one account is compromised. Using separate elevated access for approved administrative tasks also aligns with privileged access management and role-based access control best practices.
- B. Incorrect.
This is incorrect because changing the password more often does not address the core least-privilege problem: technicians are still using a highly privileged shared account for routine work. A shared account also weakens accountability and auditing because actions cannot be reliably tied to a single person. Although password managers can help manage credentials, they do not make excessive privileges acceptable.
- C. Incorrect.
This is incorrect because placing all technicians in the local Administrators group on every workstation grants broad administrative rights far beyond what many help desk tasks require. This increases attack surface and makes lateral movement easier if a technician account is compromised. It improves convenience, but it violates least privilege.
- D. Incorrect.
This is incorrect because splitting one shared admin account into multiple shared accounts may reduce some exposure, but it still relies on shared credentials and still grants elevated rights through accounts not tied to individual users. Least privilege is not just about dividing tasks; it also includes limiting permissions to the minimum necessary and maintaining accountability through unique identities.