The concept of least privilege is a security principle that requires giving each user, service, and application only the permissions needed to perform their work and no more12. It is one of the most important concepts in network and system security, as it reduces the attack surface and the risk of unauthorized access, data breaches, and malware infections12. The statement B best describes this concept, as it implies that the vendor follows the principle of least privilege by granting people access to the minimum necessary to do their job. The other statements do not capture the essence of the concept, as they either describe other security practices (such as dual authorization and separation of duties) or limit the scope of the concept to a specific type of access (such as root and administrator access).

References:

1: 9 Ways to Prevent Third-Party Data Breaches in 2024 | UpGuard

2: Best Practice Guide to Implementing the Least Privilege Principle - Netwrix