Least privilege

Least privilege says every subject, whether a person, a service account, or a running process, should hold exactly the access its job needs and nothing more. The reasoning is blast-radius control: if an account can only reach what its task requires, then an error, a piece of malware running in its context, or a stolen credential can only do that much damage.

The principle shows up everywhere the exam looks. It underpins separation of duties, which splits privilege across people, and it is the standing answer to over-permissioned service accounts, the very weakness Kerberoasting exploits when a cracked service account turns out to be a domain admin. It also pairs with need-to-know: least privilege governs the actions you can take, need-to-know governs the specific data you may see.

Exam relevance: least privilege is the reflexive best answer to “how should access be assigned” questions and to scenarios where an account had more rights than its role required. Distinguish it from need-to-know (data visibility) and from separation of duties (splitting a process). It is a preventive control aimed at containing, not detecting, misuse.