What is the principle of least privilege and why is it important?

• A. Rotating passwords monthly regardless of need
• B. Enforcing MFA for all actions
• C. Granting users and processes only the minimum rights needed; reduces attack surface and limits impact of compromised accounts
• D. Giving all users admin rights

Answer: (C)

The main concept tested here is the principle of least privilege: give users and processes only the minimum rights they need to do their job. This approach minimizes what can be accessed or executed, so if an account is compromised or a process is exploited, the potential damage is limited. It reduces the attack surface by preventing unnecessary permissions from being available, makes it easier to detect abnormal activity, and contains the impact by restricting lateral movement and access to sensitive resources. In practice, you assign the smallest set of permissions required, segment duties so sensitive tasks require elevated authority through controlled workflows, and use mechanisms like just-in-time access or role-based controls to grant higher privileges only when needed.

Rotating passwords regularly, while useful for general security hygiene, does not enforce limited permissions. Requiring MFA for all actions strengthens authentication but doesn’t address whether users have more privileges than necessary. Giving all users admin rights directly violates the principle by granting excessive access.