Which statement best describes the principle of least privilege in cloud security?

• A. Grants broad access
• B. Applies to network segmentation only
• C. Enforces least privilege to reduce blast radius
• D. Ignores IAM policies

Answer: (C)

Least privilege in cloud security means granting each identity the minimum permissions needed to perform their tasks, no more. This keeps access tightly scoped so if credentials are compromised or a mistake is made, the potential damage is limited—the blast radius is minimized, and actions are easier to audit and roll back.

The best statement captures this by saying we enforce least privilege to reduce the blast radius. It emphasizes the core outcome of the principle: restricting what an account or service can do to prevent widespread impact.

Grants of broad access run counter to this idea because they increase potential damage. Limiting the scope of permissions is essential, not treating the concept as something only relevant to network boundaries. And ignoring IAM policies would defeat the very mechanism we use to implement least privilege, since those policies define and enforce who can do what.