CompTIA CASP+ Practice Test

Which policy is violated when a finance user has access to human resource data, especially when they don't work in that department?

1. Access control

2. Data management

3. Least privilege

4. Accountability

The correct answer is: Least privilege

The principle of least privilege is violated in the situation described, where a finance user has access to human resource data even though they do not belong to that department. The principle of least privilege dictates that users should only be granted the minimum level of access necessary to perform their job functions effectively. This minimizes potential exposure to sensitive information and reduces the risk of unauthorized disclosure or data breaches. In this scenario, the finance user should only have access to the financial records and resources pertinent to their role. Allowing access to human resource data does not align with their job responsibilities and poses a significant risk, as it could lead to the misuse of sensitive employee information. Maintaining strict access controls based on departmental needs and specific job functions is crucial for safeguarding data and ensuring compliance with data protection regulations. Therefore, adherence to the least privilege principle is essential for limiting access to sensitive information only to those who genuinely require it for their roles.