Define the principle of least privilege and describe how it should be implemented in IAM.

• A. Grant broad access to speed up work
• B. Use MFA only for admins
• C. Remove all permissions and trust users
• D. Grant users only minimum rights needed; implement via RBAC, ABAC, just‑in‑time privileges, and regular access reviews

Answer: (D)

The principle of least privilege means giving each user only the minimum rights they need to do their job, and nothing more. In IAM, this is put into practice by structuring access around roles and attributes so permissions are tightly controlled. RBAC assigns permissions by role, ensuring people receive only what their role requires. ABAC uses user attributes such as department, project, or clearance to determine access, adding fine-grained control. Just‑in‑time privileges allow temporary elevation with approval and automatic expiration, so heavy permissions aren’t held indefinitely. Regular access reviews help catch drift and revoke any unused or outdated rights. Together, these approaches provide continuous enforcement of minimal access.

This fits best because it clearly states granting minimum rights and outlines concrete methods to implement and maintain that principle. The other choices miss the mark: granting broad access directly contradicts least privilege; MFA for admins focuses on authentication rather than authorization; removing all permissions is not workable in practice.