Is it best practice to grant the least permissions believed to be necessary initially and then add permissions if appropriate?

• A. True
• B. False
• C. Depends on the situation
• D. Not applicable

Answer: (A)

The principle of least privilege guides this question: grant only the minimum permissions needed for a task, and add more only as required. Starting with the smallest set of rights reduces the risk of accidental damage, limits what an attacker could do if a credential is compromised, and makes monitoring and auditing easier. If additional access is genuinely necessary, elevate privileges in a controlled way—ideally just-in-time or through a formal approval process—and revoke them when no longer needed. This iterative approach keeps permissions aligned with actual needs, improving security without unduly hindering work. In practice, this is the recommended path, with any exceptions handled by ensuring rapid revocation and tight controls.