Is it good practice when assigning initial permissions to start with more permissions than strictly necessary and then remove permissions later?

• A. True
• B. False
• C. Depends on the situation
• D. Not applicable

Answer: (B)

Starting with more permissions than needed goes against the principle of least privilege. Granting minimum access up front reduces the attack surface and makes auditing easier. If you begin with broad rights, the window for misuse expands and a compromised account or accidental actions can cause greater damage. Tracking and revoking those permissions later can also be error-prone, especially if there are dependencies or cascading effects from the elevated access. The right approach is to assign only what’s necessary at the start and use controlled, time-limited elevation (with approvals) when additional rights are truly needed, followed by prompt revocation and regular access reviews. In emergencies, temporary elevation may be warranted, but it should be tightly governed and not the default practice.