Which practice best supports the principle of least privilege in access control?

• A. Granting all users administrator rights by default.
• B. Restricting access to essential personnel based on job needs.
• C. Providing constant access to contractors.
• D. Granting access based on the minimum necessary to perform a job.

Answer: (D)

Least privilege means giving each user only the permissions they truly need to do their job, nothing more. This minimizes risk if an account is compromised, or if a mistake is made, because the user cannot access or affect resources they don’t need for their work. The best practice here is granting access based on the minimum necessary to perform a job. That directly implements the principle by tying every permission to a specific, required task and eliminating extra access that could be misused. It also supports safer, more auditable control over who can do what.

Granting administrator rights by default exposes everything to everyone, creating unnecessary risk. Providing constant access to contractors can bypass time-bound or job-specific needs, increasing exposure. Restricting access to essential personnel aligns with limiting access but must be explicitly tied to the minimum necessary permissions for each role to avoid over- or under-provisioning.