What is the main idea of the principle of least privilege?

• A. Limit access rights to the minimum needed for duties
• B. Provide broad access to streamline operations
• C. Grant access only during emergencies
• D. Remove all authentication controls

Answer: (A)

Restricting each user’s permissions to the minimum necessary to perform their duties.

This principle reduces risk by ensuring no one can access or modify systems or data beyond what they truly need. It limits potential damage from mistakes, insider misuse, or compromised credentials, and it makes it easier to audit and enforce who can do what. In practice, you grant the smallest set of rights, use roles and need-to-know access, and regularly review and adjust permissions.

So the best choice is to limit access rights to the minimum needed for duties. The other options increase risk or ignore basic security controls: broad access undermines security, emergency-only access isn’t the standard operating model, and removing authentication controls is unsafe.