A contractor at a shipping depot needs a VPN sign-in and read access to one shipment share for two weeks. The admin is about to add the contractor to the domain administrators group because that group can already reach the share. Which principle does that choice violate?

Least privilege limits an account to the access required for its task and no more. The contractor needs a VPN sign-in and read access to one shipment share for a short engagement. Membership in domain administrators grants broad control of identities and systems across the depot, which is far beyond reading one share. That gap is the violation, even though the powerful group can technically open the share. Role-based access is the tempting name, because the admin is using a group. A role is the right way to grant the VPN and the share. The principle fails when the role also includes domain administration, not because a group was used. Separation of duties splits a sensitive job across two people so one person cannot complete it alone. Reading a shipment file over a VPN is one task, not two conflicting duties. Zero trust means you verify the account and give it only what it needs. Creating a limited contractor account is compatible with that idea. The violation is the extra rights, not the existence of the account. Exam caveat: least privilege and role-based access work together. A role can bundle the VPN and the one share, and it still fails least privilege if it includes domain administration. Operational check: list the contractor account's group memberships and share permissions, remove domain administrators, grant read on only that share, and set the account to expire at the end of the two weeks.