I85PREP
⌘ K
NSA Assessment study materials
NSA Assessment study resources

NSA Assessment practice questions

One question at a time. Build your NSA Assessment understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Network Security Fundamentals

In the TCP/IP model, which layer is responsible for logical addressing and routing of packets between networks?

  1. Transport layer
  2. Internet layer Correct answer.
  3. Network access layer
  4. Application layer

Explanation

The Internet layer of the TCP/IP model handles logical addressing (IP addresses) and routing, deciding how packets travel between networks. The transport layer manages end-to-end connections, and the network access layer handles the physical link.

Question 2Network Security Fundamentals

Which protocol operates at the transport layer and provides connection-oriented, reliable delivery with acknowledgments?

  1. UDP
  2. ICMP
  3. TCP Correct answer.
  4. ARP

Explanation

TCP establishes a connection and uses sequence numbers and acknowledgments to guarantee ordered, reliable delivery. UDP is connectionless, while ICMP and ARP operate at other layers for diagnostics and address resolution.

Question 3Network Security Fundamentals

A workstation needs to send a packet to a host on a different subnet. What destination MAC address does the workstation place in the frame?

  1. The destination host's MAC address
  2. The default gateway's MAC address Correct answer.
  3. The workstation's own MAC address
  4. The broadcast MAC address

Explanation

When the destination IP is off-subnet, the host forwards the frame to its default gateway, so the frame's destination MAC is the gateway's. The destination IP remains the remote host's address.

Question 4Network Security Fundamentals

Which address range is reserved for private use under RFC 1918?

  1. 169.254.0.0/16
  2. 100.64.0.0/10
  3. 192.0.2.0/24
  4. 172.16.0.0/12 Correct answer.

Explanation

RFC 1918 defines 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 as private ranges not routed on the public Internet. The other options are documentation, carrier-grade NAT, and link-local ranges respectively.

Question 5Network Security Fundamentals

An engineer sees a subnet mask of 255.255.255.192. How many usable host addresses does each subnet provide?

  1. 64
  2. 30
  3. 126
  4. 62 Correct answer.

Explanation

A /26 mask leaves 6 host bits, giving 64 addresses total; subtracting the network and broadcast addresses leaves 62 usable hosts.

Question 6Network Security Fundamentals

Which device primarily forwards frames based on MAC addresses within a single broadcast domain?

  1. Layer 2 switch Correct answer.
  2. Router
  3. Load balancer
  4. Firewall

Explanation

A Layer 2 switch builds a MAC address table and forwards frames within a broadcast domain. Routers move packets between broadcast domains using IP addresses.

Question 7Network Security Fundamentals

What is the primary security weakness of ARP that enables ARP spoofing on a local network?

  1. ARP uses TCP, which allows session hijacking
  2. ARP has no authentication, so hosts accept forged replies Correct answer.
  3. ARP only works across routed subnets
  4. ARP packets are encrypted, so hosts cannot verify identity

Explanation

ARP is stateless and unauthenticated; any host can send a gratuitous or forged reply claiming an IP-to-MAC mapping. Victims then send traffic to the attacker's MAC, enabling interception.

Question 8Network Security Fundamentals

Which protocol translates domain names into IP addresses?

  1. DHCP
  2. NTP
  3. SNMP
  4. DNS Correct answer.

Explanation

DNS resolves human-readable domain names to IP addresses through a hierarchical system of name servers. DHCP assigns addresses, NTP synchronizes time, and SNMP manages devices.

Question 9Network Security Fundamentals

Which DNS record type maps a hostname to an IPv6 address?

  1. AAAA Correct answer.
  2. CNAME
  3. A
  4. MX

Explanation

An AAAA record maps a hostname to a 128-bit IPv6 address, while an A record maps to IPv4. MX identifies mail servers and CNAME creates an alias.

Question 10Network Security Fundamentals

A security team wants to reduce DNS cache poisoning risk from spoofed responses. Which measure most directly addresses this?

  1. Disabling DNSSEC validation
  2. Increasing TTL values
  3. Allowing recursive queries from any host
  4. Using randomized source ports and query IDs Correct answer.

Explanation

Randomized source ports and transaction IDs make it much harder for an off-path attacker to guess the parameters needed to inject a forged response. DNSSEC adds cryptographic validation but must be enabled, not disabled.

Question 11Network Security Fundamentals

Which protocol uses a three-way handshake to establish a connection?

  1. IP
  2. ICMP
  3. TCP Correct answer.
  4. UDP

Explanation

TCP uses SYN, SYN-ACK, and ACK to synchronize sequence numbers and confirm both sides are ready. UDP and ICMP do not establish connections this way.

Question 12Network Security Fundamentals

Which TCP flag combination is used in a SYN flood attack to consume server resources?

  1. RST packets terminating connections
  2. ACK packets with valid sessions
  3. FIN packets after normal close
  4. SYN packets with spoofed source addresses Correct answer.

Explanation

A SYN flood sends many SYN packets, often with spoofed sources, so the server allocates half-open connection state and never receives the final ACK. This exhausts the backlog queue.

Question 13Network Security Fundamentals

What does a stateful firewall primarily track to make filtering decisions?

  1. Only the destination port of each packet
  2. The MAC address vendor of each host
  3. The state of active connections, such as established sessions Correct answer.
  4. The DNS record type in each query

Explanation

A stateful firewall maintains a connection table and permits return traffic for sessions it has already allowed. This allows it to distinguish established flows from unsolicited inbound packets.

Question 14Network Security Fundamentals

An organization places a firewall between the Internet and its internal network and a second firewall between the internal network and a DMZ. What architecture does this describe?

  1. Flat network with no segmentation
  2. Host-based only protection
  3. Screened subnet with dual firewalls Correct answer.
  4. Single-homed host

Explanation

A screened subnet (DMZ) design often uses an external firewall facing the Internet and an internal firewall separating the DMZ from the internal network. This limits exposure if a DMZ host is compromised.

Question 15Network Security Fundamentals

Which protocol provides encrypted remote shell access and is commonly used to replace Telnet?

  1. TFTP
  2. SNMPv1
  3. SSH Correct answer.
  4. FTP

Explanation

SSH encrypts the session and authenticates the server, protecting credentials and data in transit. Telnet, FTP, TFTP, and SNMPv1 send data in cleartext.

Question 16Network Security Fundamentals

Which TLS weakness is addressed by disabling support for SSLv3 and TLS 1.0?

  1. Use of certificate pinning
  2. Reliance on forward secrecy
  3. Weak legacy ciphers and known protocol vulnerabilities such as POODLE Correct answer.
  4. Excessive key length in modern ciphers

Explanation

Older protocol versions permit weak ciphers and contain design flaws such as POODLE in SSLv3. Disabling them forces clients to negotiate stronger TLS versions and cipher suites.

Question 17Network Security Fundamentals

What is the main purpose of network segmentation in a security program?

  1. To eliminate the need for authentication
  2. To increase broadcast domain size
  3. To limit lateral movement and contain breaches Correct answer.
  4. To reduce the number of IP addresses required

Explanation

Segmentation divides networks into zones with controlled traffic paths, so a compromised host cannot freely reach sensitive systems. It supports least-privilege access and containment.

Question 18Network Security Fundamentals

Which technology creates an encrypted tunnel over an untrusted network to connect a remote user to a corporate network?

  1. NAT
  2. VPN Correct answer.
  3. VLAN
  4. STP

Explanation

A VPN encapsulates and encrypts traffic between the client and a gateway, providing confidentiality and integrity over untrusted links. VLANs segment local networks, NAT translates addresses, and STP prevents Layer 2 loops.

Question 19Network Security Fundamentals

Which IPsec component provides confidentiality of the payload?

  1. IKE
  2. AH
  3. ESP Correct answer.
  4. SA

Explanation

Encapsulating Security Payload (ESP) can encrypt the payload and optionally authenticate it. Authentication Header (AH) provides integrity and authentication but no confidentiality.

Question 20Network Security Fundamentals

An analyst observes a flood of traffic from many source IP addresses to a single web server, exhausting its connection table. Which attack type is this?

  1. ARP spoofing
  2. VLAN hopping
  3. Distributed denial of service Correct answer.
  4. DNS tunneling

Explanation

A DDoS attack uses many distributed sources to overwhelm a target's resources, such as its connection table. ARP spoofing and VLAN hopping are local Layer 2 attacks, and DNS tunneling exfiltrates data.

Question 21Network Security Fundamentals

Which practice best mitigates VLAN hopping via switch spoofing?

  1. Disabling DTP and hard-setting access ports as access mode Correct answer.
  2. Allowing untagged frames on trunk ports
  3. Using the native VLAN for all user traffic
  4. Enabling dynamic trunking on all access ports

Explanation

Attackers exploit dynamic trunking negotiation to turn an access port into a trunk. Disabling DTP and explicitly configuring ports as access mode prevents this negotiation.

Question 22Network Security Fundamentals

What does 802.1X provide on a wired or wireless network?

  1. Link aggregation for bandwidth
  2. Address translation for private hosts
  3. Port-based network access control with authentication Correct answer.
  4. Loop prevention using spanning tree

Explanation

802.1X authenticates a supplicant through an authenticator to a RADIUS server before granting port access. It does not aggregate links, prevent loops, or translate addresses.

Question 23Network Security Fundamentals

Which wireless security configuration provides the strongest protection among the listed options?

  1. WPA with TKIP
  2. WEP with a 128-bit key
  3. Open network with MAC filtering
  4. WPA2-Personal with AES-CCMP Correct answer.

Explanation

WPA2-Personal using AES-CCMP is the strongest of these choices; WEP and TKIP have known cryptographic weaknesses and MAC filtering is trivially bypassed.

Question 24Network Security Fundamentals

What is the primary function of a DMZ in a network security design?

  1. To provide encryption for internal traffic
  2. To host externally accessible services while isolating them from the internal network Correct answer.
  3. To store backups of internal databases
  4. To replace the need for firewalls

Explanation

A DMZ hosts Internet-facing services in a segment separated from the internal network, so compromise of a public server does not directly expose internal systems.

Question 25Network Security Fundamentals

An attacker on the same subnet sends forged router advertisement messages to redirect hosts' default gateways. Which mitigation most directly addresses this?

  1. Deploying RA Guard on access switches Correct answer.
  2. Enabling IPv6 only
  3. Increasing DHCP lease time
  4. Disabling STP

Explanation

RA Guard filters rogue router advertisement messages at the switch edge, preventing hosts from accepting unauthorized gateways. Increasing lease times or disabling STP does not address spoofed RAs.

Question 26Network Security Fundamentals

Which OSI layer is responsible for logical addressing and path selection between networks?

  1. Layer 3 (Network) Correct answer.
  2. Layer 5 (Session)
  3. Layer 2 (Data Link)
  4. Layer 4 (Transport)

Explanation

Layer 3 handles logical addressing such as IPv4 and IPv6 and determines routing between distinct networks. Layer 2 deals with physical addressing and framing inside one link, while Layer 4 manages end-to-end delivery and ports. Path selection is therefore a network-layer function performed by routers.

Question 27Network Security Fundamentals

Which statement describes the difference between a collision domain and a broadcast domain?

  1. A collision domain is the set of devices whose frames can collide, while a broadcast domain is the set of devices that receive each other's broadcasts. Correct answer.
  2. A collision domain is defined by IP subnets, while a broadcast domain is defined by MAC addresses.
  3. A collision domain spans routers, while a broadcast domain is limited to one switch port.
  4. A collision domain applies only to wireless links, while a broadcast domain applies only to fiber links.

Explanation

A collision domain contains devices that share a medium and can therefore interfere with each other's transmissions; switches create one per port. A broadcast domain contains devices that receive a broadcast frame, and it typically ends at a router interface or a VLAN boundary. The two concepts are independent, so one broadcast domain can contain many collision domains.

Question 28Network Security Fundamentals

A host with address 10.20.30.40/26 needs to reach a server at 10.20.30.70. What is the correct determination?

  1. The server is on a different subnet, so the host drops the packet without notifying the application.
  2. The server is on a different subnet, so the host forwards the frame to its default gateway. Correct answer.
  3. The server is on the same subnet, so the host broadcasts the frame to all hosts.
  4. The server is on the same subnet, so the host sends the frame directly to the server's MAC address.

Explanation

A /26 mask leaves six host bits, giving subnets of 64 addresses; the host's subnet covers 10.20.30.0 through 10.20.30.63. The server at 10.20.30.70 falls in the next subnet, 10.20.30.64/26. Because the destination is off-subnet, the host resolves the gateway's MAC address and sends the frame there.

Question 29Network Security Fundamentals

Which statement best describes how a router differs from a Layer 2 switch in forwarding behavior?

  1. The router forwards frames by MAC address and does not change them.
  2. The router floods unknown unicast frames out all ports except the ingress port.
  3. The router forwards packets between IP networks and rewrites the Layer 2 header for the next hop. Correct answer.
  4. The router delivers packets only within a single VLAN without consulting a routing table.

Explanation

A router receives a frame, strips the Layer 2 header, consults its routing table for the destination IP network, and builds a new Layer 2 header for the next hop. This is why each router hop changes source and destination MAC addresses while the IP addresses remain the same end to end. Switches, by contrast, forward frames within a broadcast domain using a MAC address table.

Question 30Network Security Fundamentals

A company must allow inbound HTTPS to a public web server while keeping internal database servers unreachable from the Internet. Which design element most directly achieves this?

  1. Placing the web server in a screened subnet reachable from the Internet and allowing only the required ports to it Correct answer.
  2. Using a stateful firewall that permits all outbound traffic and blocks all inbound traffic
  3. Placing the web server and database servers on the same internal VLAN with host firewalls disabled
  4. Routing all inbound traffic through the internal core switch without a filtering device

Explanation

A screened subnet (DMZ) exposes only the services that must be publicly reachable and isolates them from internal systems. Firewall rules permit inbound 443 to the web server while denying inbound access to the database tier. This limits the blast radius if the public server is compromised.

Question 31Network Security Fundamentals

Which characteristic of UDP makes it attractive to attackers for reflection and amplification attacks?

  1. It encrypts payloads by default, hiding the attacker's identity.
  2. It establishes a session with a three-way handshake before sending data.
  3. It retransmits lost segments until acknowledged, multiplying traffic volume.
  4. It is connectionless and allows spoofed source addresses to elicit responses to a victim. Correct answer.

Explanation

UDP requires no handshake, so an attacker can send requests with a forged source address and the responder will direct the reply to the victim. Protocols with small requests and large responses, such as DNS or NTP, amplify the traffic. The absence of connection state is what enables this reflection technique.

Question 32Network Security Fundamentals

Which TCP behavior allows an attacker to infer whether a port is open during a SYN scan?

  1. An open port completes the handshake automatically, while a closed port sends an ACK.
  2. An open port sends an ICMP port-unreachable message, while a closed port sends nothing.
  3. An open port replies with RST, while a closed port replies with SYN-ACK.
  4. An open port replies with SYN-ACK, while a closed port replies with RST. Correct answer.

Explanation

In a half-open scan the attacker sends a SYN; a listening service answers with SYN-ACK and a non-listening port answers with RST. The scanner records the difference without completing the handshake. This response asymmetry is the basis for port-state inference in SYN scanning.

Question 33Network Security Fundamentals

Which ICMP-based technique is commonly used to map the live hosts on a subnet before deeper scanning?

  1. Flooding the subnet with gratuitous ARP replies
  2. Sending ICMP redirect messages to each host
  3. Sending a TCP FIN to every port
  4. Issuing ICMP echo requests and recording which addresses reply Correct answer.

Explanation

ICMP echo requests (ping sweeps) reveal which addresses respond, giving an initial inventory of live hosts. Many environments block echo, so scanners also probe common TCP or UDP ports as a fallback. The result guides where deeper enumeration is worthwhile.

Question 34Network Security Fundamentals

An analyst reviewing a packet capture sees a host repeatedly send ARP requests for the gateway's IP address and receive replies with different MAC addresses within seconds. Which conclusion is most defensible?

  1. The gateway is performing legitimate load balancing across multiple MAC addresses.
  2. The host is misconfigured with an incorrect subnet mask.
  3. The conflicting replies suggest ARP cache poisoning and should trigger verification of the gateway MAC. Correct answer.
  4. Duplicate ARP replies indicate normal switch flooding and require no action.

Explanation

A single IP address should map to one MAC address; conflicting replies within seconds indicate someone is answering for the gateway. This is the signature of ARP cache poisoning used for man-in-the-middle positioning. Verification against the known gateway MAC and switch port security logs is the appropriate next step.

Question 35Network Security Fundamentals

Which mechanism allows a switch to restrict which MAC addresses may appear on an access port, limiting MAC flooding and spoofing?

  1. Spanning Tree Protocol root guard
  2. Port security with a maximum MAC count and sticky addresses Correct answer.
  3. DHCP snooping with option 82 insertion
  4. BPDU guard on access ports

Explanation

Port security caps the number of source MAC addresses learned on an interface and can pin them as sticky entries. Frames from unauthorized addresses are dropped or the port is err-disabled. This directly counters MAC flooding, which tries to overflow the CAM table, and casual MAC spoofing.

Question 36Network Security Fundamentals

Which statement correctly distinguishes symmetric from asymmetric cryptography in network security?

  1. Asymmetric is always faster than symmetric and is therefore preferred for bulk data.
  2. Symmetric uses one shared key for both encryption and decryption, while asymmetric uses a key pair. Correct answer.
  3. Asymmetric uses one shared secret key distributed to both parties in advance.
  4. Symmetric uses a public key for encryption and a private key for decryption.

Explanation

Symmetric algorithms such as AES use a single shared key for both directions, which is efficient for bulk data. Asymmetric algorithms use a public and private key pair and solve the key distribution problem but are computationally heavier. Real protocols combine them, using asymmetric methods to establish a symmetric session key.

Question 37Network Security Fundamentals

A web team wants to confirm that a certificate presented by a server was issued for that exact hostname. Which certificate property is being validated?

  1. The subject alternative name extension Correct answer.
  2. The key usage extension set to key encipherment
  3. The certificate's serial number length
  4. The certificate's signature algorithm identifier

Explanation

Modern clients match the requested hostname against the subject alternative name extension, which lists the DNS names the certificate covers. The legacy common name field is no longer relied upon for this check. A mismatch produces a certificate name error in the browser.

Question 38Network Security Fundamentals

Which practice most effectively limits the impact of a compromised server certificate private key?

  1. Increasing the certificate's key length to 4096 bits
  2. Renaming the server's DNS record after the compromise
  3. Publishing the certificate through certificate transparency logs
  4. Revoking the certificate and relying on OCSP or CRL checking by clients Correct answer.

Explanation

Once a private key is exposed, the certificate can no longer be trusted, so it must be revoked and clients must check revocation status through OCSP or CRLs. Short validity periods and OCSP stapling reduce the window of exposure. Key length alone does not help because the attacker already holds the key.

Question 39Network Security Fundamentals

Which statement about NAT and its effect on security monitoring is accurate?

  1. NAT eliminates the need for a firewall because internal hosts are unreachable.
  2. NAT encrypts translated traffic, preventing inspection by intrusion detection systems.
  3. NAT hides internal addresses from external observers but complicates attributing external activity to internal hosts. Correct answer.
  4. NAT assigns public addresses to every internal host, simplifying log correlation.

Explanation

NAT rewrites addresses so external parties see only the translating device's address, which obscures internal topology. The tradeoff is that logs on the outside show the NAT address, so correlating an event to a specific internal host requires translation-table records with timestamps. NAT provides no encryption and is not a substitute for filtering.

Question 40Network Security Fundamentals

Which protocol and port pairing correctly identifies the secure replacement for unencrypted HTTP?

  1. HTTPS over TCP 443 Correct answer.
  2. Telnet over TCP 23
  3. SNMP over UDP 161
  4. FTP over TCP 21

Explanation

HTTPS wraps HTTP in TLS and by convention listens on TCP 443, providing confidentiality and integrity for web traffic. The other pairings listed carry their protocols in cleartext. Migrating from HTTP to HTTPS is a baseline hardening step for any web service.

Question 41Security Architecture and Design

In the Common Criteria, what does an Evaluation Assurance Level (EAL) primarily communicate about a Target of Evaluation?

  1. The cryptographic algorithms the product is required to implement
  2. The set of security functional requirements the product is claimed to satisfy
  3. The depth of independent testing and design review applied during evaluation Correct answer.
  4. The maximum classification of data the product is permitted to process

Explanation

EALs describe the rigor and depth of the evaluation process itself, ranging from functionally tested up to formally verified design and testing. Functional capability is captured separately by the Security Target's SFRs, so two products at the same EAL can offer very different security functions.

Question 42Security Architecture and Design

Which security model is designed to prevent a subject cleared for Secret from writing information into an object classified Confidential?

  1. Clark-Wilson integrity model
  2. Brewer-Nash model
  3. Biba integrity model
  4. Bell-LaPadula confidentiality model Correct answer.

Explanation

Bell-LaPadula addresses confidentiality with the star property, which forbids writing down to a lower sensitivity level. That rule stops a high-clearance subject from leaking classified data into a less protected object.

Question 43Security Architecture and Design

A system must ensure that a user who can approve payments cannot also create the payee records used in those payments. Which principle does this control implement?

  1. Separation of duties Correct answer.
  2. Least privilege
  3. Fail-safe default
  4. Defense in depth

Explanation

Separation of duties splits a sensitive transaction across multiple individuals so no single person can complete fraud alone. The approval and record-creation functions are deliberately assigned to different roles.

Question 44Security Architecture and Design

In the reference monitor concept, which property requires that the mediation logic be small enough to be fully analyzed and tested?

  1. Verifiability Correct answer.
  2. Non-bypassability
  3. Isolation
  4. Completeness

Explanation

Verifiability means the reference monitor is compact and simple enough that its correctness can be rigorously analyzed. Isolation keeps it tamper-proof, while completeness and non-bypassability ensure every access is checked and cannot be skipped.

Question 45Security Architecture and Design

Which statement best describes the purpose of the Trusted Computing Base (TCB)?

  1. It is the network perimeter that filters traffic entering the enclave
  2. It is the audit log repository that records all privileged actions
  3. It is the set of users granted administrative privileges on a system
  4. It is the collection of hardware, firmware, and software that enforces the security policy Correct answer.

Explanation

The TCB comprises every component whose correct functioning is necessary to enforce the security policy, including hardware, firmware, and software. Anything outside the TCB is untrusted for enforcement purposes and must be validated before reliance.

Question 46Security Architecture and Design

Which mode of operation is required when two parties must be able to verify each other's identity without prior shared secrets and without a central authority online at the time of use?

  1. Public key infrastructure with certificate chains Correct answer.
  2. TACACS+ with per-command authorization
  3. Kerberos with a trusted key distribution center
  4. RADIUS with a shared secret

Explanation

A PKI lets each party present a certificate signed by a trusted certification authority, so mutual authentication works without a live central server. Trust is anchored in the CA hierarchy rather than a shared symmetric key.

Question 47Security Architecture and Design

Which security architecture principle is illustrated by placing a web server in a screened subnet so that a compromise does not directly expose the internal database tier?

  1. Abstraction
  2. Least common mechanism
  3. Layering Correct answer.
  4. Modularity

Explanation

Layering places successive protective boundaries between an attacker and the most sensitive assets, so penetrating one layer does not grant immediate access to the core. A screened subnet is a classic example of an additional architectural layer.

Question 48Security Architecture and Design

What distinguishes a covert channel from an overt communication path in a secured system?

  1. It transmits only over out-of-band physical media
  2. It uses encryption that the system cannot decrypt
  3. It relies on a compromised administrator account
  4. It exploits a mechanism not intended for communication to transfer information Correct answer.

Explanation

A covert channel moves information through a resource whose designed purpose is not communication, such as timing or storage utilization. Overt channels are the sanctioned paths the security policy is written to control.

Question 49Security Architecture and Design

An organization wants a formal, repeatable process to decide whether a system is permitted to operate given its residual risk. Which activity does this describe?

  1. Penetration testing
  2. Vulnerability scanning
  3. Certification and accreditation Correct answer.
  4. Configuration baselining

Explanation

Certification evaluates a system against defined criteria, and accreditation is the management decision to accept residual risk and authorize operation. Scanning, testing, and baselining are technical inputs that may inform that decision.

Question 50Security Architecture and Design

A design review finds that a process running with administrative rights only needs to read one configuration file. Which change best applies least privilege?

  1. Run the process under a dedicated account granted read access only to that file Correct answer.
  2. Add detailed logging of the process's file access
  3. Move the process to a host on the screened subnet
  4. Encrypt the configuration file at rest

Explanation

Least privilege grants each subject only the accesses it genuinely requires, so a dedicated low-privilege identity scoped to the single file removes unnecessary rights. Logging, encryption, and relocation change monitoring or exposure but not the privilege level.