What is the principle of least privilege?

• A. Users are granted only privileges needed to perform tasks
• B. Users receive all privileges to maximize productivity
• C. Privileges are rotated every hour
• D. Privileges are granted by third-party auditors

Answer: (A)

The principle of least privilege means giving users only the minimum access they need to perform their tasks. By restricting what each person or process can do, you greatly reduce the potential impact of mistakes, compromised accounts, or malware. In practice this means assigning roles or permissions that cover just the necessary scope, using need-to-know and role-based access controls, and applying the same idea to service accounts and automated processes.

For example, a developer who needs to edit code should not also have access to payroll data or financial systems. A database administrator should manage only the databases they’re responsible for, not every system in the environment. Privileges should be granted through centralized access management, with temporary or just-in-time elevation used only when truly needed, and regular reviews to revoke any unused rights.

This approach is not about giving everyone all privileges, nor about rotating privileges every hour, nor about privileges being granted by auditors as a general rule. The essence is limiting access to the minimum necessary to reduce risk.