312-50V9 · Question #478
Least privilege is a security concept that requires that a user is
The correct answer is A. limited to those functions required to do the job. The principle of least privilege restricts user access to only what is necessary to perform their assigned job functions, minimizing the attack surface.
Question
Least privilege is a security concept that requires that a user is
Options
- Alimited to those functions required to do the job.
- Bgiven root or administrative privileges.
- Ctrusted to keep all data and access to that data under their sole control.
- Dgiven privileges equal to everyone else in the department.
How the community answered
(31 responses)- A87% (27)
- B3% (1)
- C3% (1)
- D6% (2)
Why each option
The principle of least privilege restricts user access to only what is necessary to perform their assigned job functions, minimizing the attack surface.
Least privilege is defined as granting users only the minimum access rights and permissions required to perform their specific job duties - nothing more. This limits the potential damage from compromised accounts or insider threats by restricting the scope of what any single user can access or modify. It is a foundational access control principle in virtually every security framework.
Granting root or administrative privileges is the opposite of least privilege, as it gives users far more access than any typical job role requires.
Giving a user sole control over data describes data ownership or custodianship, not the principle of limiting access to job-required functions.
Equal privileges across a department ignores the fact that different roles have different access needs, violating the per-role scoping that least privilege requires.
Concept tested: Principle of least privilege access control
Source: https://csrc.nist.gov/glossary/term/least_privilege
Topics
Community Discussion
No community discussion yet for this question.