What is the principle of least privilege, and how would you apply it in an organisation?

What the interviewer wants to hear

• Give only the access needed for the job, for only as long as needed
• Role-based access and regular access reviews
• Separate admin accounts and just-in-time elevation
• Limits blast radius of compromised accounts

Model answer

Least privilege means each user, service and system gets only the access it needs to do its job, and only for as long as it needs it. This limits the blast radius if an account is phished or misused. In practice I would start with role-based access, so permissions are tied to job roles instead of individuals. Admins should have separate admin accounts that are not used for email or browsing, and ideally use just-in-time elevation through tools like Privileged Identity Management, so standing admin rights are rare. Service accounts should have narrow permissions and no interactive logon. Regular access reviews remove rights people no longer need, especially after role changes or leaving. Logging privileged actions in the SIEM helps detect misuse.

More easy Cybersecurity Analyst questions

• Explain the CIA triad and give a real example of an attack on each part.
• A user reports a suspicious email. How would you analyse it?
• What is the difference between a firewall, an IDS and an IPS?
• What is a SIEM and how does a SOC analyst use it?
• Explain the difference between hashing, encryption and encoding.
• What is defence in depth, and how would you explain it with a real example?
• What is MFA, and why are some MFA methods stronger than others?
• Explain false positives and false negatives in a SOC. Which is worse, and how do you balance them?
• What is the difference between a vulnerability scan and a penetration test?