CISSP Identity and Access Management Practice Question
A security analyst is reviewing access rights and discovers an active account belonging to a former employee who left six months ago. This is an example of:
⚠ Common exam trap
The trap is conflating 'orphaned account' with 'insider threat' or 'privilege escalation'; the exam wants you to identify the specific access-control condition (unmanaged leftover account) rather than the broader risk category.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Orphaned account
An orphaned account is one that remains active after its owner no longer needs it — typically because the employee left, changed roles, or the account was never deprovisioned. A former employee's account still active six months after departure is the textbook definition of an orphaned account. It represents a significant access control failure because the account can be used without legitimate ownership.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Orphaned account
Why this is correct
An orphaned account is a user or service account that no longer has an active, accountable owner or associated employee, often due to an employee's departure without proper deprovisioning. When a security analyst discovers such an account during an access rights review, it represents a significant security vulnerability as it could be exploited without detection or used to maintain unauthorized access. These accounts pose a risk because they lack oversight and may retain elevated privileges, making them prime targets for malicious actors. Identifying them is a critical part of regular access reviews and identity lifecycle management.
- ✗
Separation of duties violation
Why it's wrong here
A separation of duties (SoD) violation occurs when a single individual possesses the authority to perform two or more critical, conflicting tasks that, if combined, could lead to fraud, error, or system compromise. While an orphaned account might indirectly contribute to an SoD issue if it's later exploited, the initial discovery of an account during an access rights review, by itself, does not directly indicate that an individual is performing conflicting duties. The scenario describes an account's status, not a conflict in assigned responsibilities.
- ✗
Account lockout
Why it's wrong here
Account lockout is a security mechanism designed to prevent brute-force attacks by temporarily disabling a user account after a predefined number of consecutive failed login attempts. While an analyst might observe an account in a locked-out state, the question describes the discovery of an underlying issue during a review of access rights, not the activation of a protective measure. The scenario implies a persistent problem with account management or ownership, not a temporary state triggered by login failures.
- ✗
Privilege escalation
Why it's wrong here
Privilege escalation refers to the unauthorized act of gaining elevated access rights or permissions within a system or network beyond what was initially granted. This typically involves exploiting vulnerabilities or misconfigurations to move from a lower-privileged user to a higher-privileged user, such as an administrator. The scenario describes a security analyst discovering an issue with an account's status during a review, not an active attempt or successful exploit to gain higher permissions.
Go deeper
Related to this question
Learn chapter
Identity and Access Management (IAM)
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
About these practice questions
This CISSP question is part of Courseiva's 816-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.