Which statement best describes the practical application of the principle of least privilege?

• A. Access should be granted on a need-to-know basis after a formal request.
• B. The principle of least privilege states users receive the minimum access necessary to perform their duties.
• C. All users should have equal access to resources.
• D. Access rights should never be reviewed.

Answer: (B)

The main idea being tested is that privileges should be restricted to the minimum necessary for a task. In practice this means assigning permissions based on what a role or duty actually requires, and giving individuals only the access they need to complete their work. This often involves role-based access control, tightly scoped permissions, and the use of elevated rights only when needed and for the shortest possible time. Regular reviews of who has which permissions help ensure access stays aligned with current duties, and additional protections like separating duties or monitoring privileged activity add layers of defense.

This description is the best fit because it states clearly that users should have only what they need to perform their duties, which is the essence of least privilege. The other options describe policies or situations that don’t capture the ongoing minimization or imply broader access than necessary; for example, granting access after a formal request can still be too broad or permanent, equal access contradicts minimal permission, and never reviewing access ignores the need to revoke unused rights.