Least privilege requires users to perform privileged functions only with privileged accounts and to use their basic (non-privileged) accounts for general activity. This prevents unnecessary exposure of elevated rights and limits attack surfaces. Database Administrators must use their DBA accounts only for DBA tasks, and all users must use their basic accounts for non-privileged tasks.

Exact Extracts:

AC.L2-3.1.5: “Employ the principle of least privilege, including for specific security functions and privileged accounts.”

Assessment Objectives: Require separate accounts for privileged and non-privileged activities.

Assessment Guide Clarification: “Privileged accounts should be used only for privileged functions; standard accounts must be used for all other activities.”

Why the other options are not correct:

B: States “non-privileged users use their basic account” but does not explicitly require all users (including admins) to use their basic account for non-privileged tasks.

C/D: Incorrectly assign System Administrator accounts to Database Administrators, which violates least privilege (admins must only have the access needed for their role).