100-160 Question 5
Single answerA small business is implementing a cybersecurity strategy for the first time. The IT manager emphasizes the importance of the principle of 'least privilege.' Which of the following actions best aligns with this principle?
- A
Granting all employees administrative access to ensure they can complete their tasks without delays
- B
Restricting access rights for users to only the resources and permissions necessary for their roles
- C
Allowing team leaders unrestricted access to all systems and data to monitor their team’s activities
- D
Creating a shared administrative account for all employees to use for elevated access when needed
Show answer and explanation
Correct answer: B
Explanation
The principle of 'least privilege' ensures users and systems are granted only the permissions they need to perform their tasks, reducing the attack surface and minimizing the risk of unauthorized actions. Option 2 correctly applies this principle by restricting access based on role requirements, while the other options provide excessive or inappropriate permissions.
- A. Incorrect.
Granting administrative access to all employees violates the principle of least privilege because it provides more access than necessary, increasing the risk of accidental or malicious misuse.
- B. Correct.
Restricting access rights to only what is necessary for a user’s role aligns with the principle of least privilege, minimizing the potential for misuse or compromise.
- C. Incorrect.
Unrestricted access for team leaders goes beyond the necessary permissions for their roles, violating the principle of least privilege.
- D. Incorrect.
Shared administrative accounts pose a security risk due to lack of accountability and violate the principle of least privilege by potentially granting excessive access.