What is the purpose of the least privilege principle in mission-critical systems?

• A. To minimize risk of misuse by restricting user rights to the minimum necessary
• B. To maximize administrator oversight
• C. To remove all access after 90 days
• D. To grant blanket access to all resources

Answer: (A)

Giving users and processes only the minimum privileges they need to perform their tasks. In mission-critical systems, keeping privileges tightly scoped limits what an attacker or a mistake can do, reducing the potential damage if credentials are compromised. This approach helps prevent unnecessary access to sensitive data, configuration settings, or critical operations, and it supports safer change management and easier auditing. Implementing it typically involves role-based access controls, need-to-know access, and just-in-time elevation for tasks that require higher rights, all backed by monitoring and regular reviews.

Why the other options don’t fit: maximizing administrator oversight focuses on supervision rather than limiting rights, removing all access after 90 days is a policy detail not tied to the core restraint of privileges, and granting blanket access to all resources directly undermines the safety that least privilege aims to provide.