220-1102 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Least privilege

  Why it's wrong here

  Least privilege is a design principle that restricts users to the minimum permissions required for their current duties, but it addresses how much access a user has, not whether the user should still be a valid account at all. Even if this former employee's account had very limited rights, the account itself remains an active threat vector because it was never removed or disabled after termination. The security failure here is not excessive entitlements assigned to the account; it is the failure to initiate deprovisioning as part of the employee offboarding process.

• ✓

  Account management

  Why this is correct

  Account management is the correct concept because it encompasses the entire identity lifecycle: provisioning accounts when employees join, reviewing access periodically, and deprovisioning accounts when employees leave. A former employee retaining network or application access indicates a breakdown in the account termination phase of account management. Effective account management requires a formal offboarding process that immediately disables or deletes accounts upon separation, revokes all associated tokens or certificates, and ensures any federated or local access is terminated.

• ✗

  Data encryption

  Why it's wrong here

  Data encryption protects the confidentiality of data while it is stored or transmitted by rendering it unreadable without the proper decryption key. Encryption does not control whether a specific user account can be authenticated or authorized to access the storage container; it simply ensures that if unauthorized access occurs, the data cannot be understood. Since the former employee's account is still active, the system likely grants legitimate authenticated access, meaning encryption would not present a barrier. The issue is an access control failure, not a cryptographic failure.

• ✗

  Role-based access control

  Why it's wrong here

  Role-based access control (RBAC) maps permissions to organizational roles rather than to individuals, and it helps manage the rights assigned to active accounts. A former employee's account may still be assigned its pre-departure role, but the violation isn't that the role is misconfigured or overly permissive; it's that the account should have been removed from the identity repository entirely. RBAC does not by itself enforce account expiry or termination workflows, so the lingering access stems from incomplete deprovisioning, not from a role-content error.

Go deeper

Related to this question