Which statement best describes least privilege in security?

Which statement best describes least privilege in security?

• A. Access rights are limited to the minimum necessary to perform tasks
• B. All users have unlimited access to data
• C. Access rights are granted randomly
• D. Access rights require biometric verification for all actions

Answer: (A)

The key idea is that access should be limited to only what is necessary for a task. This minimizes the chances of accidental damage, reduces the impact of a compromised account, and makes security easier to manage. The description that access rights are limited to the minimum necessary to perform tasks captures this principle precisely. The other options stray from this idea: granting unlimited access ignores the protection framework; granting rights randomly undermines intentional control; and requiring biometric verification for all actions is a separate control, not the defining concept of least privilege.

The key idea is that access should be limited to only what is necessary for a task. This minimizes the chances of accidental damage, reduces the impact of a compromised account, and makes security easier to manage. The description that access rights are limited to the minimum necessary to perform tasks captures this principle precisely. The other options stray from this idea: granting unlimited access ignores the protection framework; granting rights randomly undermines intentional control; and requiring biometric verification for all actions is a separate control, not the defining concept of least privilege.