The correct answer is Principle of least privilege.

Principle of least privilege means granting users and processes only the minimum permissions they need to perform their assigned tasks. This reduces the attack surface and limits the potential impact of compromised accounts and accidental misuse.

Principle of least privilege is applied by using role based permissions, just in time elevation where available, and regular review and removal of unnecessary rights. These practices help ensure that no account has more authority than required for its duties.

Identity and Access Management is a broader discipline that covers how identities are created, managed, authenticated, and authorized. It includes the concept of least privilege but it does not itself name the specific permission minimization principle.

Need to know principle focuses on restricting access to specific information based on necessity rather than on assigned tasks or system privileges. It is related but it is more about information visibility than general permission scopes for accounts and processes.

Access control refers to the mechanisms and policies used to enforce who can do what within systems. It is the umbrella under which least privilege operates and it is not the specific rule that requires granting only minimal permissions.

Full AWS Practitioner Certification Question