Which statement best describes the principle of least privilege in access control?

• A. Privileges are assigned randomly.
• B. Privileges are granted to all users equally.
• C. Users receive the minimum privileges necessary to perform their duties.
• D. Privileges are granted based on seniority only.

Answer: (C)

The idea behind least privilege is that each user or process should have only the access rights needed to do their work, nothing more. This minimizes the potential impact of mistakes, accidents, or a compromised account by limiting what can be accessed or altered.

The best description is that users receive the minimum privileges necessary to perform their duties. This aligns access with actual job needs and supports safer operation, easier auditing, and quicker removal of unnecessary rights as roles change. In practice, this often involves defining roles or need-to-know requirements, reviewing permissions regularly, and granting temporary or just-in-time access only when truly needed.

Privileges assigned randomly don’t reflect job requirements and increase risk. Giving everyone the same privileges ignores individual duties and broadens what could be misused. Granting rights based on seniority may not match what a person actually needs to perform their tasks, leading to unnecessary access that can be exploited.