312-50V10 · Question #587
Least privilege is a security concept that requires that a user is
The correct answer is A. limited to those functions required to do the job.. The principle of least privilege mandates that users receive only the minimum access rights necessary to perform their specific job functions, reducing attack surface and limiting damage from compromise.
Question
Least privilege is a security concept that requires that a user is
Options
- Alimited to those functions required to do the job.
- Bgiven root or administrative privileges.
- Ctrusted to keep all data and access to that data under their sole control.
- Dgiven privileges equal to everyone else in the department.
How the community answered
(35 responses)- A89% (31)
- B6% (2)
- C3% (1)
- D3% (1)
Why each option
The principle of least privilege mandates that users receive only the minimum access rights necessary to perform their specific job functions, reducing attack surface and limiting damage from compromise.
Least privilege restricts each user account to only the permissions, resources, and capabilities required to complete assigned tasks - nothing more. This limits the blast radius of a compromised account, prevents privilege escalation, and reduces insider threat risk. It is a foundational access control principle in frameworks such as NIST SP 800-53 and ISO 27001.
Granting root or administrative privileges is the opposite of least privilege, giving users far more access than needed for most job functions.
Sole control of data describes data ownership or custodianship concepts, not the access minimization principle that defines least privilege.
Granting equal privileges to all department members describes a flat access model, not least privilege, which requires access to be tailored to individual job requirements.
Concept tested: Principle of least privilege access control
Source: https://csrc.nist.gov/glossary/term/least_privilege
Topics
Community Discussion
No community discussion yet for this question.