Objective 1.2: Summarize fundamental security concepts

1.An organisation enforces a policy that each user account must only have the minimum permissions necessary to perform the user's assigned job duties and nothing more. Which principle does this policy implement?

2.A security engineer is hardening a Linux web server. They configure the web server process to run under a dedicated service account that has read access to web content directories, write access to log directories, and no other filesystem permissions. The account cannot execute system binaries outside the web server application, cannot access other users' home directories, and has no sudo privileges. If the web server process is compromised, the attacker operates within the constraints of this account. Which security principle does this configuration most directly implement, and what is its defensive value in a compromise scenario?

3.A user logs in to a corporate application using their employee ID number. The system then prompts for a password. What security process does entering the employee ID number represent?

4.After a security incident, forensic analysts need to prove that an administrator executed a specific privileged command on a critical server at a particular time. The administrators argue they did not perform the action. Which security principle, if properly implemented, would provide the strongest technical evidence to resolve the dispute?

5.A developer is building an API that will be consumed by third-party applications. The API must ensure that requests claiming to come from authorized applications are genuinely from those applications, that transmitted data cannot be read by intermediaries, that a received request cannot be resubmitted by an attacker who captured it to trigger the same action again, and that the application sending a request cannot later deny having sent it. Which combination of cryptographic and protocol mechanisms most precisely addresses all four requirements?