ISC2 CC Access Controls Concepts Practice Question
A retail company issues contract workers temporary accounts that automatically expire after 30 days, and it reviews all active accounts each quarter to remove those no longer needed. Which access control administration practice does the quarterly review represent?
⚠ Common exam trap
The trap here is naming the goal rather than the activity, so candidates pick least privilege when the scenario describes the recurring review process itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Access review or recertification
Periodically reviewing active accounts to confirm each is still needed and removing those that are not is an access review, also known as recertification. It works alongside automated expiration of temporary accounts by catching entitlements that persist beyond their business justification, helping the company keep access aligned with current needs and supporting least privilege over time.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
User provisioning
Why it's wrong here
Provisioning is the process of creating accounts and granting initial access when someone joins or needs a resource. The quarterly review does not create access; it examines existing accounts to find and remove stale ones. Provisioning happens at the start of the account lifecycle, whereas this review is a periodic check on accounts already in place.
- ✗
Separation of duties
Why it's wrong here
Separation of duties splits critical tasks among different people so no single person can complete a sensitive process alone. The quarterly review is about validating and cleaning up account access, not about dividing responsibilities among staff. While both are controls, separation of duties addresses task assignment rather than periodic account validation.
- ✓
Access review or recertification
Why this is correct
An access review, also called recertification, periodically examines existing accounts and entitlements to confirm they are still required and to revoke those that are not. Reviewing all active accounts each quarter to remove unneeded ones is precisely this practice. It complements the automatic expiration of temporary accounts by catching access that outlives its business need.
- ✗
Least privilege
Why it's wrong here
Least privilege means granting only the minimum access needed for a job, which is a guiding principle rather than a periodic review activity. The quarterly review supports least privilege by removing excess access, but the review itself is the administrative practice being described. Calling it least privilege confuses the objective with the activity that helps maintain it.
Go deeper
Related to this question
Learn chapter
Access Control Fundamentals
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
About these practice questions
This CC question is part of Courseiva's 989-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.