Describe the principle of least privilege and give an IAM example.

• A. Users get only necessary permissions; example: restricting a developer to their project resources.
• B. Users receive global admin rights; example: granting access to all resources.
• C. Users can request any resource after a manager approval; example: project-wide access.
• D. Users are assigned permissions for the latest security updates only.

Answer: (A)

The idea being tested is giving each user the smallest set of permissions needed to do their job. This keeps access levels tight so mistakes or abuse don’t affect other parts of the system. In IAM terms, you design roles with only the specific actions required and assign those roles to the user, rather than giving broad or global access. That way, the user can perform their tasks, like developing code within a single project, deploying for that project, and reviewing related work, but cannot reach resources outside their scope or alter permissions for others.

So, restricting a developer to their own project resources is the essence of least privilege in practice. It ensures they have what they need and nothing more, which reduces risk and improves accountability.

The other approaches go beyond or miss the point. Granting global admin rights provides far more access than necessary; a process that lets any user request access after approval can still result in broader access than needed and isn’t about minimizing permissions upfront; and focusing on updates or maintenance tasks rather than access rights misses the central idea of limiting what a user can do with resources.