Which of the following security concepts establishes the notion that a user should only be given sufficient access to the resources they need to perform their job function?

Deny all is a default-deny firewall or access control policy stance, not a principle describing the appropriate level of user privilege.

Allow all represents an unrestricted access policy, which is the opposite of the described security concept and introduces significant security risk.

Most privilege is not a recognized security concept and is the direct opposite of least privilege, describing maximum rather than minimum access.

The principle of least privilege limits the scope of what a user can access, read, write, or execute to exactly what is necessary for their role. By minimizing permissions, organizations contain the blast radius of insider threats, compromised credentials, or malware that executes in the context of a user account.