A new department has recently joined the organization and the administrator needs to compose access permissions for the group of users. Given that they have various roles and access needs, what is the best-practice approach when granting access?

Answer options:

A.After gathering information on their access needs, the administrator should allow every user to access the most common resources and privileges on the system.
B.The administrator should grant all users the same permissions and then grant more upon request. 
C.The administrator should grant all users the least privilege and add more privileges to only to those who need it.
D.Users should have no access and be granted temporary access on the occasions that they need to execute a task.

Correct Answer – C
The best-practice for AWS Identity Access Management (IAM) is to grant the least amount of permissions on the system only to execute the required tasks of the user’s role. Additional permissions can be granted per user according to the tasks they wish to perform on the system.
https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#grant-least-privilege
Option A is incorrect because granting users access to the most common resources presents security vulnerabilities, especially from those who have access to resources they do not need.
Option B is incorrect because granting users the same privileges on the system means other users might get access to resources they do not need to carry out their job functions. This presents a security risk.
Option D is incorrect because the users are part of the organisation; it will be cumbersome for the administrator to create temporal access passes for internal staff constantly.