Which concept restricts unauthorized users from gaining access to assets by granting only the minimum privileges necessary?

Which concept restricts unauthorized users from gaining access to assets by granting only the minimum privileges necessary?

• A. Phish Tank
• B. Deterrence Controls
• C. Insider Risk Controls
• D. Least privileges

Answer: (D)

The principle being tested is the practice of granting the minimum privileges necessary to perform a task. This approach restricts what each user or account can access and do, so even if credentials are compromised or a user makes a mistake, the potential damage is limited. By applying least privilege, you reduce the attack surface, make it harder for attackers to move laterally, and enforce tighter control over sensitive assets. In real systems, this means careful assignment of permissions, use of role-based access controls, separate accounts for administrative actions, and regular review of who has what level of access. The other concepts aren’t about restricting access to the bare minimum: deterrence controls focus on discouraging attacks, insider risk controls address behaviors and monitoring of trusted users, and “phish tank” isn’t a standard access-control principle.

The principle being tested is the practice of granting the minimum privileges necessary to perform a task. This approach restricts what each user or account can access and do, so even if credentials are compromised or a user makes a mistake, the potential damage is limited. By applying least privilege, you reduce the attack surface, make it harder for attackers to move laterally, and enforce tighter control over sensitive assets. In real systems, this means careful assignment of permissions, use of role-based access controls, separate accounts for administrative actions, and regular review of who has what level of access. The other concepts aren’t about restricting access to the bare minimum: deterrence controls focus on discouraging attacks, insider risk controls address behaviors and monitoring of trusted users, and “phish tank” isn’t a standard access-control principle.