Which concept ensures that access is restricted to what is necessary for a role?

Which concept ensures that access is restricted to what is necessary for a role?

• A. Layered Security in IAM
• B. Defense-in-Depth
• C. Access Control Layer
• D. Cost Justification

Answer: (C)

Least privilege is the idea that access should be limited to the minimum rights necessary for a given role. The Access Control Layer is where those role-based permissions are actually enforced. It checks each access request against the defined policies and grants or denies access accordingly, ensuring a user can perform only the actions required by their role and nothing more. That focused enforcement is what makes access align with the minimum rights principle across resources and services. Layered security in IAM and defense-in-depth describe broad strategies of adding multiple controls to reduce risk, but they don’t specify the mechanism that enforces minimal access for each role. Cost justification is unrelated to access control decisions.

Least privilege is the idea that access should be limited to the minimum rights necessary for a given role. The Access Control Layer is where those role-based permissions are actually enforced. It checks each access request against the defined policies and grants or denies access accordingly, ensuring a user can perform only the actions required by their role and nothing more. That focused enforcement is what makes access align with the minimum rights principle across resources and services.

Layered security in IAM and defense-in-depth describe broad strategies of adding multiple controls to reduce risk, but they don’t specify the mechanism that enforces minimal access for each role. Cost justification is unrelated to access control decisions.