Which statement best describes the principle of least privilege?

• A. Granting users the maximum rights needed.
• B. Providing users only the minimum rights necessary.
• C. Regularly auditing all privileges.
• D. Disabling all user permissions.

Answer: (B)

Providing users only the minimum rights necessary to perform their tasks is the essence of the least privilege principle. This approach limits what an account can do, so even if credentials are compromised or a user makes a mistake, the potential damage stays small. It also makes security management clearer: with the smallest possible set of permissions, it's easier to enforce controls, track actions, and apply the right level of access for each role. In practice, a user who only needs to view reports wouldn’t have the ability to change configurations, and elevated rights would be granted only temporarily for a specific task.

Granting maximum rights would dramatically increase risk, since users would have broad access beyond what they need. Regularly auditing privileges is important for governance and maintaining appropriate access over time, but it describes ongoing oversight rather than the core idea of giving the minimum necessary access. Disabling all permissions would render work impossible.