Which principle enforces the idea that accounts should have the minimal level of access necessary?

Which principle enforces the idea that accounts should have the minimal level of access necessary?

• A. Need-to-know
• B. Defense in depth
• C. Minimal access principle
• D. Least privilege model

Answer: (D)

Granting only the permissions needed to perform a task is the idea here. This least privilege approach reduces risk by preventing accounts from accessing resources or performing actions beyond what is truly required, so a compromised or misused account can cause less damage. Need-to-know focuses on access to specific data based on necessity, not on the overall level of system permissions. Defense in depth is about layering multiple security controls to protect assets, rather than limiting each account’s access. The term least privilege model is the standard way to describe the practice of granting minimal rights, though some might refer to it as the minimal access principle; the established term is least privilege. Implementing it involves defining roles with only the necessary privileges, applying strict file, process, and network permissions, and regularly reviewing and trimming privileges as duties change.

Granting only the permissions needed to perform a task is the idea here. This least privilege approach reduces risk by preventing accounts from accessing resources or performing actions beyond what is truly required, so a compromised or misused account can cause less damage.

Need-to-know focuses on access to specific data based on necessity, not on the overall level of system permissions. Defense in depth is about layering multiple security controls to protect assets, rather than limiting each account’s access. The term least privilege model is the standard way to describe the practice of granting minimal rights, though some might refer to it as the minimal access principle; the established term is least privilege. Implementing it involves defining roles with only the necessary privileges, applying strict file, process, and network permissions, and regularly reviewing and trimming privileges as duties change.