Study. uk . com
  1. Home
  2. All questions
  3. Question 356

CompTIA Security+ study material · question 356 of 611

A relying party requests the full user profile when it only needs a department name. What principle does this violate?

  1. Deny by default
  2. Separation of duties
  3. Requesting only the attributes needed to make the decision
  4. Least privilege on the identity provider
Show the answer

Answer: C. Requesting only the attributes needed to make the decision

Every extra attribute received becomes data the relying party must then protect for no decision benefit.

Source: NIST SP 800-63C Rev. 4 (NIST) — SP 800-63C-4 › Privacy Considerations

Challenge yourself on this topic → Study as cards