A security administrator is advocating for enforcement of a new policy that would require employers with privileged access accounts to undergo periodic inspections and review of certain job…

Question

Options

• ABackground investigation
• BMandatory vacation
• CLeast privilege
• DSeparation of duties

• A
  4% (2)
• B
  2% (1)
• C
  87% (48)
• D
  7% (4)

Explanation

The principle of least privilege states that users should have only the minimum level of access required to perform their job functions. Periodic inspections and reviews of job performance data for privileged users are a key enforcement mechanism - they ensure that employees' access rights remain aligned with their current job responsibilities and that no one retains privileges beyond what is necessary. Over time, roles change, and without periodic reviews, privilege creep occurs. Background investigations (A) are performed prior to hiring or for security clearances, not as recurring reviews of existing employees. Mandatory vacation (B) requires employees to take time off (useful for detecting fraud by observing if issues arise in their absence), but does not involve reviewing job performance data. Separation of duties (D) divides critical tasks among multiple people to prevent fraud, rather than reviewing individual privilege levels.

No community discussion yet for this question.