The correct answer is Assigning each user only the minimal permissions required to perform their assigned duties.

This principle means each account gets only the access needed to do assigned work and nothing extra. Limiting permissions in this way reduces the attack surface and limits what an attacker or compromised account can do.

Practical implementations include mapping roles to job duties using role based access control granting time bound or just in time elevation and performing regular entitlement reviews to remove unnecessary rights.

The option Providing users broad permissions so they can perform any task without delay is incorrect because broad permissions increase risk and enable privilege abuse and lateral movement instead of restricting access.

The option Cloud Identity and Access Management is incorrect because it names a category of tools that can enforce least privilege but it is not the definition of the principle. Tools support enforcement but they do not describe what least privilege is.

The option Giving users the same access level as administrators is incorrect because granting administrator level access to all users removes critical controls. Administrator rights must be restricted and granted only when strictly required.

Full AWS Practitioner Certification Question