Multiple choice technology security

The principle of least privilege as it applies to Access control mandates that:

  1. Group based access control should be implemented to assign permissions to application users

  2. Consistent authorization checking should be performed on all application pages

  3. A set of all allowable actions should be defined for each user role and all other's denied

  4. All failed access authorization requests should be logged to a secure location for review by administrators
Reveal answer Fill a bubble to check yourself
C Correct answer
Explanation

The principle of least privilege means granting only the minimum necessary permissions to users. Defining all allowable actions for each role and denying everything else (deny-by-default) implements this principle correctly. Group-based access (A) is an implementation detail, not the principle itself. Consistent authorization checks (B) is important for security but doesn't define least privilege. Logging failed attempts (D) is an auditing practice, not authorization.

Keep practicing — related questions