(ISC)2 Certified in Cybersecurity Practice Exam

What does the principle of least privilege specify?

1. Users should have unrestricted access to all systems

2. Users should only have the minimum access necessary to perform their duties

3. All users must share the same access level

4. Admin privileges should be granted to all staff

The correct answer is: Users should only have the minimum access necessary to perform their duties

The principle of least privilege emphasizes that users should be granted only the minimum level of access necessary to perform their job functions. This approach limits the exposure of sensitive data and reduces the risk of accidental or malicious damage to systems. By restricting user permissions, the potential for misuse—whether intentional or unintentional—decreases, thus enhancing the overall security posture of an organization. Incorporating this principle helps to mitigate the impact of breaches, as compromised accounts would have limited access to critical systems, making it harder for an attacker to move laterally within the network. It also simplifies compliance with regulations that demand careful management of user access rights. By ensuring that users do not have access beyond what is needed, organizations can better protect their assets and reduce the attack surface. The other choices reflect broader or unrestricted access philosophies that do not align with best security practices, making them less effective in safeguarding an organization's data and systems.