Which principle guides access control in DPAS 1020?

• A. Need-to-know
• B. Separation of duties
• C. Least privilege
• D. Mandatory access control

Answer: (C)

Least privilege is the guiding principle for DPAS 1020 access control. The idea is to grant each user only the minimum permissions necessary to perform their duties, which reduces the risk if an account is compromised and makes auditing clearer. In DPAS, access is tied to roles and tasks, ensuring someone can do their job without extra rights that could expose sensitive data or functionality. Need-to-know is related in that it restricts access to specific data, but it operates under the broader goal of least privilege rather than defining the main rule. Separation of duties focuses on preventing fraud by dividing responsibilities, not on limiting each user’s access to the minimum necessary. Mandatory access control is a specific model; the primary guidance for DPAS 1020 remains granting the least privileges.