Which policy change best prevents unauthorized escalation of privileges?

Which policy change best prevents unauthorized escalation of privileges?

• A. Increase administrative rights for efficiency.
• B. Log when elevated privileges are used.
• C. Disable access reviews.
• D. Assign least privilege to perform the task.

Answer: (D)

The principle of least privilege is being tested: give each user only the minimum rights necessary to perform their job. When privileges are restricted to what’s actually needed, even if an account is compromised, the attacker cannot easily climb to higher, unauthorized levels because those elevated permissions aren’t granted by default. This approach directly prevents unauthorized escalation by design, since tasks are completed with only the permissions required. It’s reinforced by access control mechanisms like role-based access control, separation of duties, and just-in-time access, which keep permissions tight and auditable. Logging when elevated privileges are used is still important for detecting abuse and tracing actions, but it doesn’t stop an escalation from occurring on the first attempt. Increasing administrative rights increases risk rather than reduces it. Disabling access reviews removes a check that keeps permissions aligned with current roles, allowing unnecessary rights to linger. Assigning the least privilege to perform the task provides the strongest preventive control against unauthorized privilege escalation.

The principle of least privilege is being tested: give each user only the minimum rights necessary to perform their job. When privileges are restricted to what’s actually needed, even if an account is compromised, the attacker cannot easily climb to higher, unauthorized levels because those elevated permissions aren’t granted by default.

This approach directly prevents unauthorized escalation by design, since tasks are completed with only the permissions required. It’s reinforced by access control mechanisms like role-based access control, separation of duties, and just-in-time access, which keep permissions tight and auditable.

Logging when elevated privileges are used is still important for detecting abuse and tracing actions, but it doesn’t stop an escalation from occurring on the first attempt. Increasing administrative rights increases risk rather than reduces it. Disabling access reviews removes a check that keeps permissions aligned with current roles, allowing unnecessary rights to linger. Assigning the least privilege to perform the task provides the strongest preventive control against unauthorized privilege escalation.