The answer is logical access controls, specifically the failure to enforce the least privilege principle through automated termination of access for terminated employees. This control objective is non-compliant because SOC 2 Type II access control non-compliance arises when a cloud service provider cannot guarantee that access rights are promptly revoked upon role changes or separation; without automated deprovisioning, terminated employees retain system access, creating a persistent risk of unauthorized data exposure or compromise. On the Certified Cloud Security Professional CCSP exam, this scenario tests your understanding of identity and access management (IAM) controls within the Cloud Platform and Infrastructure Security domain, where auditors look for automated, timely revocation rather than manual quarterly reviews. A common trap is confusing periodic user access reviews with real-time deprovisioning—reviews detect stale access, but they do not prevent it. Remember the mnemonic “LAP” for Least privilege, Automated deprovisioning, and Prompt revocation to avoid this pitfall.
CCSP Legal, Risk and Compliance Practice Question
This CCSP practice question tests your understanding of legal, risk and compliance. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A cloud service provider (CSP) is undergoing a SOC 2 Type II audit. The auditor reviews the CSP's access control policies and identifies that user access reviews are performed quarterly. However, the auditor notes that there is no automated termination of access for terminated employees. Which TWO of the following control objectives are likely to be non-compliant based on this finding?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Least privilege principle
The lack of automated termination of access for terminated employees directly violates the least privilege principle (B), which requires that users have only the minimum access necessary to perform their job functions. Without automated deprovisioning, terminated employees retain access, creating a persistent risk of unauthorized data access or system compromise. This control objective is non-compliant because the CSP cannot ensure that access rights are promptly revoked when no longer needed.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Change management procedures
Why it's wrong here
Change management is not directly impacted by access termination.
✓
Least privilege principle
Why this is correct
Failure to revoke access violates least privilege.
Related concept
Read the scenario before looking for a memorised answer.
✓
Logical access controls
Why this is correct
Logical access controls include timely revocation of access upon termination.
Related concept
Read the scenario before looking for a memorised answer.
✗
Encryption of data at rest
Why it's wrong here
Encryption is not directly related to access termination.
✗
Physical access controls
Why it's wrong here
Physical access controls are separate from logical access.
Common exam traps
Common exam trap: answer the scenario, not the keyword
ISC2 often tests the distinction between logical access controls (which include user account management, authentication, and authorization) and other control domains like change management or physical security, leading candidates to overlook that the finding directly impacts logical access controls (C) and least privilege (B) simultaneously.
Detailed technical explanation
How to think about this question
Automated termination of access typically integrates with an identity and access management (IAM) system that triggers deprovisioning via HR system feeds (e.g., SCIM protocol) or directory synchronization (e.g., LDAP/Active Directory). Without this automation, manual quarterly reviews introduce a window of exposure where terminated employees could still authenticate via SAML, OAuth, or API keys, potentially exfiltrating data or modifying configurations. In a SOC 2 Type II audit, the lack of automated termination is a critical deficiency because it fails the 'timely revocation' control criterion under the CC6.1 and CC6.2 trust services criteria.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A developer is choosing between AES-256 (symmetric) and RSA-2048 (asymmetric) for encrypting a large file that will be sent to a partner. Symmetric encryption is fast but requires key exchange; asymmetric is slower but solves the key distribution problem. A hybrid approach — encrypt the file with AES, encrypt the AES key with RSA — is standard. Questions like this test whether you understand when each approach applies.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Legal, Risk and Compliance — This question tests Legal, Risk and Compliance — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Least privilege principle — The lack of automated termination of access for terminated employees directly violates the least privilege principle (B), which requires that users have only the minimum access necessary to perform their job functions. Without automated deprovisioning, terminated employees retain access, creating a persistent risk of unauthorized data access or system compromise. This control objective is non-compliant because the CSP cannot ensure that access rights are promptly revoked when no longer needed.
What should I do if I get this CCSP question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.