An administrator is reviewing a recent security audit and determines that two users in finance also have access to the human resource data. One of those users fills in for any HR employees on vacation, the other user only works in finance.
Which of the following policies is being violated by the finance user according to the audit results?
A . Mandatory vacation
B . Non-disclosure
C . Job rotation
D . Least privilege
Answer: D