Skip to content

CLF-C02 · Study Guide

← Chapter 2: Security & Identity

2.3

Least Privilege & MFA

Grant only required permissions; require MFA especially for privileged access.

Key points

  • Least privilege limits blast radius.
  • Example: read-only S3 access should not include delete.
  • MFA adds a factor beyond password.

Least privilege

Give a user or application only the permissions it actually requires.

Example

If an application only needs to read objects from S3, it should not unnecessarily receive permission to delete S3 objects.

MFA

MFA stands for Multi-Factor Authentication. It adds an additional authentication factor beyond a password.

MFA improves security, particularly for privileged access.

Exam focus

Least privilege is the answer when a question asks for minimum necessary permissions.