CISSP Identity and Access Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Orphaned account

  Why this is correct

  An orphaned account is a user or service account that no longer has an active, accountable owner or associated employee, often due to an employee's departure without proper deprovisioning. When a security analyst discovers such an account during an access rights review, it represents a significant security vulnerability as it could be exploited without detection or used to maintain unauthorized access. These accounts pose a risk because they lack oversight and may retain elevated privileges, making them prime targets for malicious actors. Identifying them is a critical part of regular access reviews and identity lifecycle management.

• ✗

  Separation of duties violation

  Why it's wrong here

  A separation of duties (SoD) violation occurs when a single individual possesses the authority to perform two or more critical, conflicting tasks that, if combined, could lead to fraud, error, or system compromise. While an orphaned account might indirectly contribute to an SoD issue if it's later exploited, the initial discovery of an account during an access rights review, by itself, does not directly indicate that an individual is performing conflicting duties. The scenario describes an account's status, not a conflict in assigned responsibilities.

• ✗

  Account lockout

  Why it's wrong here

  Account lockout is a security mechanism designed to prevent brute-force attacks by temporarily disabling a user account after a predefined number of consecutive failed login attempts. While an analyst might observe an account in a locked-out state, the question describes the discovery of an underlying issue during a review of access rights, not the activation of a protective measure. The scenario implies a persistent problem with account management or ownership, not a temporary state triggered by login failures.

• ✗

  Privilege escalation

  Why it's wrong here

  Privilege escalation refers to the unauthorized act of gaining elevated access rights or permissions within a system or network beyond what was initially granted. This typically involves exploiting vulnerabilities or misconfigurations to move from a lower-privileged user to a higher-privileged user, such as an administrator. The scenario describes a security analyst discovering an issue with an account's status during a review, not an active attempt or successful exploit to gain higher permissions.

Go deeper

Related to this question