Cloud Digital Leader Google Cloud Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Principle of least privilege

  Why this is correct

  Principle of least privilege is the security doctrine mandating that any user, process, or system component be granted only the minimum permissions essential to perform its prescribed functions. By restricting privileges to the exact scope of job duties, it minimizes the attack surface and contains the blast radius of a compromised credential, preventing lateral movement or unauthorized data access. This principle is foundational to access control and directly answers the question about how much permission a user should receive.

• ✗

  Defence in depth

  Why it's wrong here

  Defense in depth is a layered security strategy that employs multiple independent controls—such as network firewalls, intrusion detection systems, and endpoint protection—to protect resources without relying on any single measure. It is a resilience framework designed to slow down attackers and provide redundancy, but it does not prescribe how user entitlements are assigned. In contrast to least privilege, defense in depth focuses on the breadth of security mechanisms rather than the granularity of permissions, making it the wrong answer to the question about permission granting.

• ✗

  Separation of duties

  Why it's wrong here

  Separation of duties is an internal control principle that breaks sensitive tasks into steps performed by different individuals so that no single person possesses end-to-end control over a critical process. Its purpose is to prevent fraud and conflicts of interest by requiring collusion to abuse systems, not to limit permissions to the minimum needed for a role. While it can indirectly reduce excessive authority, it addresses task allocation rather than the direct principle of granting only the necessary access, so it does not answer the permission-scoping question.

• ✗

  Zero trust

  Why it's wrong here

  Zero trust is a comprehensive security model built on the mantra 'never trust, always verify,' requiring continuous authentication and authorization for every access attempt, regardless of the user's location or previous trust level. It is an architectural philosophy that incorporates elements like microsegmentation and continuous monitoring, rather than a focused principle for assigning minimal user permissions. Although least privilege is a component of zero trust, the model itself is broader and does not specifically define the extent of permission grants, making it incorrect for this question.

Go deeper

Related to this question