What is the practice of giving an employee access to only the resources needed to accomplish their job?

Question

Options

• Aprinciple of least privilege
• Borganizational separation
• Cseparation of duties
• Dneed to know principle

• A
  95% (20)
• D
  5% (1)

Explanation

Principle of Least Privilege is correct because it specifically defines the security practice of granting users only the minimum access rights and resources necessary to perform their assigned job functions - nothing more, nothing less. This limits the potential damage from accidents, errors, or unauthorized use.

Why the distractors are wrong:

• B. Organizational separation refers to dividing departments or business units to reduce conflicts of interest, not controlling individual resource access.
• C. Separation of duties is about requiring multiple people to complete sensitive tasks (e.g., one person requests a payment, another approves it) to prevent fraud - it's about task division, not access restriction.
• D. Need to know is a similar but narrower concept, typically applied to classified information access based on mission necessity; it's often confused with least privilege but is more specific to sensitive/classified data contexts.

Memory Tip: Think of least privilege like a hotel key card - a guest only gets access to their room, not every room in the building. "Least" = minimum access needed = least privilege. If you see language about job-based resource access, always think least privilege.

No community discussion yet for this question.