Which statement best describes the principle of least privilege and its significance in IT security?

• A. Users are granted maximum access rights to ensure efficiency.
• B. Users are granted minimum access rights necessary; reduces attack surface and potential damage.
• C. All users are given identical privileges for simplicity.
• D. Access rights are assigned randomly.

Answer: (B)

Granting each user only the minimum permissions they need to perform their tasks keeps control tight and risk low. When privileges are limited to what’s necessary, the system’s “blast radius” shrinks: if an account is compromised or malware runs under that account, the attacker can access only a small, expected set of resources rather than entire systems. This approach also reduces the chance of accidental changes or damage, makes auditing and accountability clearer, and allows easier revocation or adjustment of access when roles change. In practice, it’s supported by using well-defined roles and carefully reviewing who has what rights, ensuring service accounts and human users only have what they absolutely require to do their jobs.

Granting maximum access would undo these protections by giving broad reach to anyone who can log in. Providing identical privileges to all users ignores individual job needs and greatly increases risk. Assigning access at random would produce inconsistent, insecure permissions with no basis for why someone has certain rights.