ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question
During deployment of a background service on a Linux production server, the installer suggests running it as root even though the program only needs to read /etc/app.conf and write logs under /var/log/app/. To uphold least-privilege principles, which action should the deployment team take?
Reuse the existing database administrator account because it already has access to system directories and reduces account sprawl.
Execute the binary with the setuid root bit so it can open any required files regardless of their ownership.
Create a dedicated service account with no shell access and grant it read rights to the configuration file and write rights only to the application's log directory.
Run the service as root but restrict its network access with a host-based firewall rule.
The principle of least privilege requires that software run with only the permissions it truly needs. Creating a dedicated, non-login service account and granting it read access to /etc/app.conf and write access to /var/log/app/ satisfies the service's requirements without exposing the system to the risks of unnecessary root privileges. Running as root, using setuid root, or reusing a high-privilege account all provide excessive permissions, and adding firewall rules does not mitigate the local risks posed by elevated rights.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is the principle of least privilege?
Open an interactive chat with Bash
Why is running a service as root risky?
Open an interactive chat with Bash
What is a dedicated service account, and why is it used?
Open an interactive chat with Bash
What is the principle of least privilege in security?
Open an interactive chat with Bash
Why is running a service as root considered a security risk?
Open an interactive chat with Bash
What is a setuid root bit and why is it not recommended in this scenario?
Open an interactive chat with Bash
ISC2 Certified Secure Software Lifecycle Professional (CSSLP)