A new analyst joins a team and needs to read three specific schemas. What is the correct way to provision their access?
Select an answer to reveal the explanation.
Short Explanation
You grant exactly what the job needs in the platform's access control. Give the analyst read access to only those three schemas, not admin rights, bucket keys, or a dashboard note. Least privilege is the control that actually works.
Full Explanation
The correct approach is to grant read access on those schemas through the platform's access control, giving no more than the role requires. Least privilege means the entitlement matches the role: read on the three schemas required, nothing more. That is enforced for every engine and interface and is auditable. Granting administrator rights so their access never has to be revisited is incorrect because administrator rights grant far more than reading three schemas, including the ability to change controls, and convenience is never a justification for privilege escalation. Giving them the connection details for the underlying bucket and letting them read the files is incorrect because bucket credentials bypass the governance layer entirely and cannot express table- or column-level restrictions. Adding a note to the team's dashboard describing which data they should avoid is incorrect because guidance is not enforcement; an unenforced instruction produces no control and no audit evidence. For the exam, provision least privilege through the platform's access control layer.