Why are least privilege and need-to-know policies insufficient without monitoring and auditing?

Why are least privilege and need-to-know policies insufficient without monitoring and auditing?

• A. Monitoring is optional for least privilege implementations.
• B. Without monitoring, abuse or misconfigurations may go unnoticed; auditing detects anomalous behavior and ensures accountability
• C. Auditing only increases overhead and has no value.
• D. Least privilege automatically guarantees full compliance.

Answer: (B)