ISC2 CISSP Practice Question

The correct answer identifies 'privilege creep' as the security risk. Privilege creep, also known as access accumulation, occurs when users progressively gain more access rights over time as they move between different roles within an organization, but their old permissions are not revoked. This practice directly violates the principle of least privilege, which dictates that users should only have the minimum permissions necessary to perform their current job functions. Retaining unnecessary permissions, such as a network engineer having DBA rights, expands the attack surface and increases the risk of unauthorized access or data misuse should the account be compromised. Regular access reviews and proper de-provisioning of obsolete rights during role transitions are essential to prevent privilege creep.