What best describes a least-privilege access certification?

• A. Grant all users admin rights by default.
• B. Certification is optional for non-admins only.
• C. Remove all privileges during certification.
• D. Regularly verify and certify that users hold only necessary privileges.

Answer: (D)

Understanding least-privilege access certification means recognizing that access rights should be regularly reviewed and confirmed to match a person’s current role. It’s an ongoing process where owners or managers validate that each user still holds only the privileges they truly need, and make adjustments if someone changes roles or if over-privileged access is discovered. This regular verification helps prevent privilege creep and keeps access aligned with evolving responsibilities and security policies. It isn’t about giving admin rights by default, nor about making certification optional for some users, and it isn’t about removing all privileges during the review. Instead, privileges are continuously reviewed and only the necessary ones are retained, with changes applied as needed. For example, a user in a non-administrative role would have their permissions checked and adjusted to remove any unnecessary elevated rights.