What does the principle of least privilege require?

• A. Grant all users full access
• B. Limit access to physical security measures
• C. Require authentication only
• D. Provide minimum rights necessary

Answer: (D)

The principle of least privilege means giving users and processes only the permissions they need to perform their tasks. By restricting access to the minimum level necessary, you reduce the potential damage from mistakes or compromised credentials and limit what a user or program can change or access.

In practice, this means assigning the smallest set of rights to each role or account and avoiding broad access. For example, someone who only reviews documents should have read access, not delete or modify rights, and a background service should run with just the permissions it requires—no extra privileges.

Choices that grant everyone full access miss the point entirely, focusing on loose or excessive permissions rather than controlled access. Relying only on authentication ignores what a user is allowed to do once authenticated. And concentrating on physical security measures misses the core need to restrict digital access. Providing minimum rights necessary captures the intended security control.