What is the core principle of the access control system described as denying all by default unless allowed?

What is the core principle of the access control system described as denying all by default unless allowed?

• A. Provide access to all resources by default.
• B. Use time-based access that resets daily.
• C. Establish an access control system that denies all by default and allows access only based on need to know.
• D. Enable open access with occasional auditing.

Answer: (C)

Default-deny access, aligned with least-privilege, is the principle described. Start by blocking access to all resources, then grant permissions only when there is a documented business need for a specific user, role, or process. This approach minimizes risk because nothing is accessible unless explicitly allowed, so a compromised credential can’t automatically access everything. The “need to know” aspect reinforces that access is granted only to what is necessary to perform a job task, nothing more. In PCI DSS terms, this means restricting access to cardholder data to those with a legitimate business purpose and regularly reviewing and revoking permissions when they’re no longer needed. The other options describe more permissive or time-limited setups but don’t capture the fundamental policy of denying by default and granting access strictly on need.

Default-deny access, aligned with least-privilege, is the principle described. Start by blocking access to all resources, then grant permissions only when there is a documented business need for a specific user, role, or process. This approach minimizes risk because nothing is accessible unless explicitly allowed, so a compromised credential can’t automatically access everything. The “need to know” aspect reinforces that access is granted only to what is necessary to perform a job task, nothing more. In PCI DSS terms, this means restricting access to cardholder data to those with a legitimate business purpose and regularly reviewing and revoking permissions when they’re no longer needed. The other options describe more permissive or time-limited setups but don’t capture the fundamental policy of denying by default and granting access strictly on need.