The principle of least privilege

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which approach follows the principle of least privilege?

A Give a new student helper access only to the files they need for their job

B Give a new student helper access to every file so you never get asked for more

2. Which account should you use for everyday tasks like browsing and writing homework?

A A standard user account

B An administrator account

3. A hacker steals the password of a standard user account. Compared with a stolen administrator account, the damage is likely to be:

A The same, because all accounts can do the same things

B Smaller, because the account has fewer permissions

4. Which statement is true about the principle of least privilege?

A It applies to users, programs and devices

B It only applies to human users

5. A student leaves the school robotics club. What should the club's IT team do with their access to the club's shared folder?

A Keep it, just in case they come back one day

B Remove it, because they no longer need it

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1role = "standard user"		AAlex's access was never removed after leaving. Access that is no longer needed should be removed.
2remove_access("Sam", "payroll")		Bif task == "install": use("admin")
3A student account is stolen, but it can only read class files, so the damage is limited.		Cpermissions = ["read"]
4Use a standard user account for daily work and an administrator account only when needed.		DThe student has admin access but only needs to read notes. Give them a standard user role instead, which follows least privilege.
5role = "administrator" # for a student who only reads notes		ETakes away access that is no longer needed, such as when someone changes jobs.
6# Alex left the team last term access = ["files", "email", "server"]		FGives the account only everyday access, which is enough for normal tasks and follows least privilege.

Definitions

principle of least privilege

Fill in the Blanks

Complete each line of code by filling in the missing parts.

newUser.accountType ← ________

GRANT ______ ON students TO reportApp

______ ALL ON students FROM oldIntern

____ apt install printer-driver

chmod ___ payroll.csv

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A # Mia only types homework

B account = 'administrator'

C can_install_apps = False

Question 2

A app = 'PrintHelper'

B app.allow('print')

C app.allow('all_other_access')

Question 3

A left_team = True

B if left_team:

C keep('team_drive')

Question 4

A account = 'student'

B access = 'all_school_files'

C # If stolen, damage is small

Question 5

A def set_access(user):

B if user.is_teacher:

C return 'edit_class'

D return 'edit_everything'

Answer Key

The principle of least privilege

Section A: Quick Questions

A — Give a new student helper access only to the files they need for their job

A — A standard user account

B — Smaller, because the account has fewer permissions

A — It applies to users, programs and devices

B — Remove it, because they no longer need it

Section B: Match the Pairs

role = "standard user" → Gives the account only everyday access, which is enough for normal tasks and follows least privilege.

remove_access("Sam", "payroll") → Takes away access that is no longer needed, such as when someone changes jobs.

A student account is stolen, but it can only read class files, so the damage is limited. → permissions = ["read"]

Use a standard user account for daily work and an administrator account only when needed. → if task == "install": use("admin")

role = "administrator" # for a student who only reads notes → The student has admin access but only needs to read notes. Give them a standard user role instead, which follows least privilege.

# Alex left the team last term access = ["files", "email", "server"] → Alex's access was never removed after leaving. Access that is no longer needed should be removed.

Section C: Definitions

principle of least privilege — Give every user, program and device only the minimum access it needs to do its job. This limits the damage if an account is stolen, and unneeded access should be removed.

Section D: Fill in the Blanks

newUser.accountType ← standard

GRANT SELECT ON students TO reportApp

REVOKE ALL ON students FROM oldIntern

sudo apt install printer-driver

chmod 600 payroll.csv

Section E: Spot the Error

B — Mia only types homework, so she needs a standard account. An administrator account gives far more access than the job needs. It should be account = 'standard'.

C — The print app should only be allowed to print. Allowing all other access breaks least privilege. It should be app.deny('all_other_access').

C — Access that is no longer needed should be removed. Someone who has left the team should lose access to the team drive. It should be revoke('team_drive').

B — Limited access means a stolen account can only cause limited damage. Access to all school files would let a thief do much more harm. It should be access = 'own_files_only'.

D — Everyone who is not a teacher should get only the minimum access. Giving them permission to edit everything gives too much. It should be return 'view_own_work'.