An administrator is reviewing a recent security audit and determines that two users in finance also have access to the human resource data. One of those users fills in for any HR employees on…

Mandatory vacation policies require employees to take leave so that fraud or misconduct can be detected in their absence, which is unrelated to unauthorized data access.

Non-disclosure policies govern whether employees share confidential information outside the organization, not whether they have been improperly granted internal access.

Job rotation involves periodically moving employees through different roles to prevent fraud and build redundancy, which does not apply to a user who permanently holds only a finance role.

Least privilege requires that users be granted only the minimum access necessary to perform their assigned job duties. The finance-only user has no legitimate business need for HR data, meaning their access exceeds what their role requires. This excess access is precisely what least privilege policies are designed to prevent.