What security principle is being adhered to when a user's access request is declined, despite meeting the necessary security clearance, because there is no business justification for the access?

Question

Options

• ASeparation of duties
• BTwo-person control
• CNeed to know
• DLeast privilege

• A
  3% (1)
• B
  3% (1)
• C
  88% (28)
• D
  6% (2)

Explanation

The 'Need to Know' principle dictates that having a sufficient security clearance level is not enough on its own - the individual must also have a legitimate business justification (a 'need to know') to access specific information or resources. This is distinct from Least Privilege (granting only minimum permissions needed for a job function) and Separation of Duties (dividing critical tasks among multiple people). The scenario specifically highlights the absence of a business justification as the reason for denial, which is the hallmark of Need to Know.

No community discussion yet for this question.