100-160 Question 1
Select 3A company is implementing a new security policy to protect sensitive data. The IT team has decided to follow the principle of 'least privilege' across all systems and users. Which of the following actions align with this principle?
- A
Granting users access only to the files and systems they need to perform their job responsibilities
- B
Providing administrative privileges to all employees to ensure they can troubleshoot their own issues
- C
Regularly reviewing user access permissions and revoking access no longer required
- D
Allowing temporary access to additional systems for users who have specific, time-bound tasks
- E
Enabling unrestricted access to shared resources for all users to encourage collaboration
Show answer and explanation
Correct answers: A, C, D
Explanation
The principle of least privilege ensures that users only have access to the resources and systems necessary for their specific tasks. This minimizes the risk of accidental or intentional misuse of systems and data. Actions like restricting access, reviewing permissions, and allowing temporary access for specific tasks align with this principle, while providing unnecessary privileges or unrestricted access does not.
- A. Correct.
Correct: Limiting user access strictly to what is necessary for their role directly aligns with the principle of least privilege.
- B. Incorrect.
Incorrect: Granting administrative privileges to all employees violates the principle of least privilege by giving unnecessary access rights.
- C. Correct.
Correct: Regularly reviewing and revoking unnecessary permissions ensures that access levels remain appropriate and minimizes security risks.
- D. Correct.
Correct: Allowing temporary access for specific, time-bound tasks supports the principle of least privilege while addressing business needs.
- E. Incorrect.
Incorrect: Unrestricted access to shared resources can expose sensitive data to unauthorized users, which goes against the principle of least privilege.