Which practice provides users with only enough access privilege to allow them to perform their assigned tasks?

Which practice provides users with only enough access privilege to allow them to perform their assigned tasks?

• A. Separation and rotation of duties
• B. Least privileges
• C. Insider Risk Controls
• D. Phish Tank

Answer: (A)

The practice being tested is giving users only the minimum permissions they need to perform their assigned tasks. This is the principle of least privilege: by restricting access to only what is necessary, you reduce the potential impact of a compromised account or a mistaken action, making systems more secure and easier to audit. Why this is the best fit: when users operate with the smallest possible set of privileges, there’s less chance for a bad actor to move laterally or access sensitive resources they don’t need. It also makes it easier to track exactly what each user is allowed to do and holds them accountable for their actions. Other options describe different security ideas. Separation and rotation of duties prevents conflicts of interest and fraud by dividing tasks among people and periodically rotating roles, not specifically about limiting each person’s day-to-day permissions. Insider risk controls cover a broad range of measures to detect and prevent misuse by insiders, rather than defining the precise grant of access. Phish Tank refers to phishing awareness training, which targets user behavior rather than access rights.

The practice being tested is giving users only the minimum permissions they need to perform their assigned tasks. This is the principle of least privilege: by restricting access to only what is necessary, you reduce the potential impact of a compromised account or a mistaken action, making systems more secure and easier to audit.

Why this is the best fit: when users operate with the smallest possible set of privileges, there’s less chance for a bad actor to move laterally or access sensitive resources they don’t need. It also makes it easier to track exactly what each user is allowed to do and holds them accountable for their actions.

Other options describe different security ideas. Separation and rotation of duties prevents conflicts of interest and fraud by dividing tasks among people and periodically rotating roles, not specifically about limiting each person’s day-to-day permissions. Insider risk controls cover a broad range of measures to detect and prevent misuse by insiders, rather than defining the precise grant of access. Phish Tank refers to phishing awareness training, which targets user behavior rather than access rights.