Which computer security concept is violated when a web server is written that uses the "root" account for all interactions with a Linux system?

Question

Options

• Aprinciple of least privilege
• BPermitRootLogin
• Ccertificate-based authentication
• DRBAC

• A
  78% (39)
• B
  14% (7)
• C
  2% (1)
• D
  6% (3)

Explanation

Running a web server as root violates the principle of least privilege (A) because the account is granted far more permissions than needed - if the server is compromised, the attacker gains full system control. Least privilege dictates that any process should operate with only the minimum access rights required for its function.

Why the distractors are wrong:

• B (PermitRootLogin) is an SSH configuration directive that controls whether root can log in via SSH - it's a setting, not a security concept.
• C (Certificate-based authentication) deals with how identity is verified (using cryptographic certificates instead of passwords) - unrelated to privilege levels.
• D (RBAC) - Role-Based Access Control is a mechanism for implementing least privilege, not the concept being violated; also, using root bypasses RBAC entirely rather than violating it directly.

Memory tip: Think of least privilege like a janitor's keycard - it should only open the rooms they need to clean, not every door in the building. Root is the master key, and handing it to a web server is handing the master key to anyone who walks through the front door.

No community discussion yet for this question.