Which statement best describes the principle of least privilege in access control?

• A. Maximize user productivity by default.
• B. Log all user activity for auditing.
• C. Grant users only the minimum level of access necessary to perform their job functions.
• D. Require multifactor authentication for all access.

Answer: (C)

The principle of least privilege means giving each user the minimum access rights they need to perform their job tasks. This limits what a user can do or access, so even if their account is compromised or an error is made, the potential damage is kept small. It also makes it easier to enforce separation of duties and to audit who has access to what, since permissions are restricted to what’s strictly necessary for their role.

For example, a software developer might need access to the code repository and development tools, but not access to payroll data or HR records. An everyday user might only need to view certain files, not modify sensitive configurations. Granting only these minimal rights aligns with secure, responsible access management.

The other options describe related concepts but don’t capture the core idea. Maximizing productivity by default would grant too many privileges. Logging all user activity relates to auditing, not to the level of access granted. Requiring multifactor authentication strengthens identity verification, but it doesn’t specify restricting privileges once identity is established.