Which principle states that a role should be assigned the least privileges necessary?

• A. Aligning privileges with business functions
• B. Using role hierarchy and privilege inheritance to build an access control model
• C. Principle of least privilege
• D. Separation of duties

Answer: (C)

Principle of least privilege states that a role should be granted only the minimum privileges necessary to perform its tasks. This keeps the attack surface small and reduces potential damage from compromised credentials or mistakes, because users can’t access or do things they don’t need for their job. The other ideas touch related concepts but don’t name this formal rule: aligning privileges with business functions is about ensuring access supports job needs, but doesn’t specify the minimal access restriction; using a role hierarchy and privilege inheritance is about how permissions are organized and inherited; separation of duties focuses on dividing tasks to prevent fraud.