100-160 Question 4
Select 2Your organization has recently implemented a new file-sharing service for employees. As a cybersecurity technician, you recommend applying the principle of 'least privilege' to ensure security. Which of the following actions best align with this principle?
- A
Grant users access only to the files they need to perform their job duties.
- B
Provide all employees administrative access to the file-sharing system to ensure operational flexibility.
- C
Regularly review and revoke access for users who no longer need it.
- D
Allow temporary contractors unrestricted access to all files to avoid delays in their onboarding process.
- E
Require strong passwords and multi-factor authentication for accessing the system.
Show answer and explanation
Correct answers: A, C
Explanation
The principle of 'least privilege' ensures that users have only the minimum level of access necessary to perform their work. Granting minimal access and regularly reviewing permissions help reduce the risk of unauthorized access or misuse of resources. Options 1 and 3 align with this principle, while the other options either violate it or are unrelated.
- A. Correct.
Granting users access only to the files they need to perform their job duties aligns with the principle of least privilege by minimizing access to only what is necessary.
- B. Incorrect.
Providing all employees administrative access violates the principle of least privilege, as it grants excessive permissions that can increase the risk of unauthorized actions or breaches.
- C. Correct.
Regularly reviewing and revoking access for users who no longer need it ensures that unnecessary privileges are removed, maintaining alignment with the principle of least privilege.
- D. Incorrect.
Allowing temporary contractors unrestricted access to all files violates the principle of least privilege by providing excessive access beyond what is necessary for their role.
- E. Incorrect.
Requiring strong passwords and multi-factor authentication is a good security practice but is not directly related to the principle of least privilege, which focuses on limiting access rights.