Need-to-know verification is required before granting access.

• A. The host verifies need-to-know before granting access
• B. Need-to-know is irrelevant
• C. Access is granted automatically without verification
• D. JPAS determines need-to-know

Answer: (A)

Need-to-know verification ensures access is granted only to those with a legitimate and specific need for that resource. The host responsible for the resource is in the best position to assess whether the requester’s role, project, and current duties actually require access, and to time-bound it as necessary. This hands-on check supports the principle of least privilege, reducing unnecessary exposure of sensitive information or areas.

Central systems or databases may provide background information or clearance data, but they don’t by themselves authorize access. The final decision rests with the host or resource owner who can apply context, policy, and current needs. Automatically granting access bypasses essential control, and treating need-to-know as irrelevant ignores a fundamental element of secure access.

So, the host verifies need-to-know before granting access.