Which principle restricts access to resources to the minimum necessary for a user's role?

• A. Principle of Least Privilege
• B. Privacy
• C. Protocol
• D. Recovery (Cold Site)

Answer: (A)

Giving users only the minimum rights they need to perform their role is the core idea behind access control. This question is testing the principle of least privilege, which means each user or process gets just the permissions necessary to do their job and nothing more. By limiting privileges, you reduce the potential damage from mistakes or compromised accounts and make it harder for an attacker to move laterally or access sensitive systems.

For example, a software developer might need access to code repositories and build tools but not to payroll data or financial records. Limiting their access to only what they need keeps sensitive information safer and makes auditing what actions are taken easier.

Privacy is about protecting personal data, not about restricting what a user can do with systems. A protocol is a set of rules for communication, not a principle that governs access rights. A recovery (cold site) relates to disaster recovery locations and continuity planning, not to access control.