200-201 Security Policies and Procedures Practice Question
A security analyst discovers that a former employee's user account remains active 45 days after termination, and audit logs show that the account was used to access a file server twice in the past week. Which element of the access control lifecycle was MOST directly violated?
⚠ Common exam trap
The trap here is assuming any access problem is a permissions problem, when the real issue is that the identity should no longer have existed at all.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Account deprovisioning
The account of a terminated employee should have been disabled as part of the offboarding process. Its continued activity 45 days later shows the deprovisioning step of the identity lifecycle failed. Effective programs integrate HR termination events with identity management so accounts are disabled automatically, and they run periodic access reviews to catch accounts that slip through manual processes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Credential rotation
Why it's wrong here
Credential rotation is the periodic changing of passwords, keys, or certificates to limit the usefulness of stolen credentials. While rotation is a good practice, it does not address the core problem here: an identity that should no longer exist still has valid access. Even a freshly rotated password on a terminated employee's account remains a violation, because the account itself should have been disabled rather than merely given a new secret.
- ✓
Account deprovisioning
Why this is correct
Deprovisioning is the lifecycle stage that removes or disables access when a user leaves the organization. The account should have been disabled on the employee's last day, but it remained active for 45 days and was used to reach a file server. This directly indicates a breakdown in the termination workflow, such as missing HR-to-IT notifications or absent automated account-disable rules tied to HR status changes.
- ✗
Privilege escalation review
Why it's wrong here
A privilege escalation review examines whether users have accumulated more rights than their roles require, such as unnecessary administrative permissions. That is a separate control from account termination. Here the account was used to reach a file server, which may have been within its original permissions. The violation is that a terminated identity retained any access at all, not that its rights were excessive during employment.
- ✗
Account provisioning
Why it's wrong here
Provisioning covers creating accounts and granting initial permissions when a user joins or changes roles. In this scenario, the account was correctly created during employment, so provisioning itself worked as designed. The failure occurred after employment ended, when access rights should have been removed. Blaming provisioning misidentifies the lifecycle stage, which would lead the analyst to review onboarding workflows instead of the termination process that actually failed.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.