A building inspections unit applies Zero Trust to seasonal parks staff accounts. Which practice best reflects the least-privilege principle?
Select an answer to reveal the explanation.
Short Explanation
Least privilege is a temporary park pass, not a master key to city hall — give seasonal inspectors only what the job needs, then take it back. If you'll grant only a standing edit role for the season, allow only compliant devices with MFA, or grant only review-confirmed permissions for next season, you're still giving more than the job needs for longer than it's needed.
Full Explanation
Building inspections applying Zero Trust to seasonal parks staff should grant only the Microsoft 365 roles and site permissions needed for inspections work, then remove excess rights promptly. That is least privilege: minimum standing access for the job, time-bounded where possible, with offboarding that actually revokes rights when the season ends. Granting only the Parks Seasonal Inspector role with standing edit access to inspections sites for the parks season fails because least privilege demands time-bounded, minimal permissions, not a standing role that persists for the entire season without prompt removal after the work ends. Allowing only compliant devices with multifactor authentication to open inspections SharePoint libraries for seasonal work fails because least privilege is about granting only the permissions needed for the job, not about layering device and sign-in conditions on top of potentially excessive access. Granting only inspections site permissions confirmed by quarterly access reviews for returning staff next season fails because least privilege requires removing excess rights promptly when the season ends, not perpetuating permissions through reviews that assume returning staff will need the same access again. Exam caveat: Least privilege questions often include distractors that grant only a standing role with broad access, allow only compliant devices with multifactor authentication without trimming permissions, or grant only permissions confirmed by quarterly reviews. Choose minimal roles/permissions plus timely removal. Operational check: place seasonal inspectors in a group with only required licenses and SharePoint/Teams roles, avoid privileged directory roles, enable auditing, set a calendar reminder for season end, remove group membership and disable or delete accounts per HR offboarding, and spot-check that former seasonal accounts no longer access inspections sites.
Prefer to study offline? Printable PDF study book + test engine ($7.50, unofficial). These questions stay free here.