100-160 Question 27
Single answerYour organization has implemented role-based access control (RBAC) to manage access to sensitive data. As part of an incident review, you discover that a user from the Marketing team has accessed financial records, which should only be available to the Finance team. Which access management principle was likely violated?
- A
Least Privilege
- B
Separation of Duties
- C
Authentication
- D
Need-to-Know
Show answer and explanation
Correct answer: A
Explanation
The principle of least privilege ensures that users only have the access necessary to perform their job duties. In this scenario, the Marketing user having access to financial records violates this principle, as their role should not require such access. Proper implementation of least privilege would have prevented this incident.
- A. Correct.
This principle ensures that users have the minimum level of access required to perform their job responsibilities. The marketing user having access to financial records suggests that this principle was not enforced.
- B. Incorrect.
This principle involves dividing tasks and responsibilities among multiple individuals to reduce the risk of fraud or error. While important, it is unrelated to the scenario described.
- C. Incorrect.
Authentication refers to verifying a user's identity, such as through a password or biometric method. The issue in the scenario is about access rights, not identity verification.
- D. Incorrect.
The need-to-know principle restricts access to information based on whether it is required for a user's specific tasks. While related, the broader issue here is the lack of minimal access enforcement, which is part of the least privilege principle.