ISC2 CISSP Practice Question

Under least privilege, each user or process is granted only the permissions required to perform authorized tasks. By reducing privileges, the organization narrows the attack surface and limits how far an attacker-or a well-intentioned user making a mistake-can reach into sensitive resources. Minimizing excess rights therefore prevents unauthorized access or misuse of information and constrains the impact of potential breaches. Considerations such as system performance, regulatory compliance, or administrative convenience are useful side effects but not the core security objective.