In least privilege, what is the purpose of regular permission reviews?

• A. Increase user permissions over time.
• B. Identify and remove excessive rights.
• C. Move all access to admin roles.
• D. Eliminate RBAC.

Answer: (B)

Regular permission reviews ensure users only have the rights they actually need and remove privileges that have become excessive. This keeps access aligned with current roles and reduces the chance that a compromised account or an error can be used to access sensitive systems. By identifying and removing excessive rights, you’re actively tightening the security boundary around each user.

Increasing permissions over time would erode least privilege, since it allows broader access than necessary. Moving all access to admin roles would grant widespread elevated privileges, increasing risk rather than limiting it. Eliminating RBAC would remove the structured way we assign and enforce access rights, making it harder to manage who can do what.