When considering least privilege, what is the goal for access permissions?

• A. To allow access to all resources
• B. To grant maximum capabilities
• C. To restrict access to only what is necessary
• D. To provide access based on seniority

Answer: (C)

The goal of least privilege is to restrict access to only what is necessary for a user to perform their job functions. This principle is central to information security because it minimizes the potential exposure to risks and reduces the attack surface. By granting users only the permissions they need, organizations can mitigate the chances of accidental or malicious misuse of sensitive data and resources.

This approach not only helps in protecting confidential information but also limits the potential damage that could occur if a user's account is compromised. In environments where least privilege is effectively implemented, security breaches are less likely, and if they do occur, the scope of the impact is minimized.

The other options do not align with the concept of least privilege. Allowing access to all resources would increase vulnerability, granting maximum capabilities would counteract the principle of minimal access, and providing access based on seniority does not necessarily align with the actual needs of the user in relation to their specific tasks.