What is the relation between need-to-know and least privilege?

• A. They are unrelated concepts.
• B. They both limit access to information and resources to what is necessary for the task.
• C. They require granting all access to most users.
• D. They only apply to physical access, not data.

Answer: (B)

Restricting access to only what is needed to perform a task. Need-to-know means someone can access specific data only if there’s a justified reason for that particular task, while least privilege means giving a user only the minimal set of permissions required to do their job. Used together, they limit both the data someone can see and the actions they can perform, reducing the risk of exposure or misuse. For example, a human resources worker might view only the records they need for their duties, and a service account would have only the permissions necessary to run its processes. They are complementary approaches to access control, not unrelated, and they apply to data and system actions—not just physical access.