Which of the following BEST helps to mitigate risk associated with excessive access by authorized users?

Monitoring user activity using security logs is a detective control, meaning it identifies excessive access after it occurs or is exploited, rather than proactively preventing it.

Revoking access for users changing roles is an important process for managing access lifecycle, but it primarily addresses changes in privilege, not the initial granting of minimal necessary access.

Granting access based on least privilege means users are given only the minimum permissions necessary to perform their job functions. This proactive approach inherently limits the potential damage an authorized but compromised or malicious user can cause by restricting their scope of access.

Conducting periodic reviews of authorizations granted is a detective and corrective control that verifies adherence to least privilege, but it doesn't establish least privilege in the first place.