What is the principle of least privilege, and how is it commonly enforced?

• A. Users get only the minimum rights needed; enforced via RBAC, fine-grained permissions, and regular access reviews.
• B. Users get maximum rights for efficiency; enforced via admin discretion.
• C. Users are not authenticated; enforced by network segmentation.
• D. Users get rights based on seniority; enforced by HR.

Answer: (A)

The principle of least privilege means giving each user only the minimum rights they need to perform their job, nothing more. This limits what a user can do and helps reduce the impact if credentials are compromised or a mistake is made.

In practice, this is enforced through several common approaches. Role-based access control (RBAC) assigns permissions based on a user’s role, so people get only the capabilities their role requires. Permissions can be fine-grained, meaning access is allowed at a specific level or action for each resource, rather than broad blanket rights. Regular access reviews check who still needs which permissions and revoke anything no longer necessary as roles and tasks change. Some environments also adopt just-in-time elevation, granting elevated access only for a limited period when needed and automatically revoking it afterward.

Why the other ideas don’t fit: giving maximum rights undermines security and defeats the purpose; authentication and network segmentation address different layers (verifying identity and limiting network reach) rather than controlling exact privileges; and basing rights on seniority or leaving access decisions to HR doesn’t ensure that technical privileges align with what a user actually needs to do.