CISSP Identity and Access Management Practice Question
Which of the following is a process that ensures users periodically confirm they still need access to systems and data?
⚠ Common exam trap
CISSP often tests the confusion between recertification and deprovisioning; candidates may think deprovisioning includes periodic reviews, but deprovisioning is the actual removal of access, while recertification is the review that may trigger it.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Recertification
Recertification is the process where users periodically confirm that they still require access to systems and data. It involves reviewing user accounts and permissions to ensure they remain appropriate, often as part of access control audits. This directly matches the description.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deprovisioning
Why it's wrong here
Deprovisioning is the systematic process of revoking a user's access rights and associated resources when their employment terminates or their role changes significantly. This action is critical for security, ensuring that former employees or those no longer requiring specific access cannot exploit old permissions. It is a reactive measure triggered by an event, not a routine, proactive review of ongoing access appropriateness.
- ✗
Separation of duties
Why it's wrong here
Separation of duties is a fundamental internal control designed to prevent fraud and error by ensuring that no single individual has complete control over all aspects of a critical transaction or process. It involves distributing responsibilities among multiple employees, requiring collusion to commit malicious acts. This principle focuses on task distribution rather than the periodic validation of user access permissions.
- ✓
Recertification
Why this is correct
Recertification is the essential periodic process of formally reviewing and validating that users' current access rights and privileges remain appropriate and necessary for their assigned job functions. This proactive measure ensures adherence to the principle of least privilege over time, identifying and remediating instances of 'privilege creep' where users accumulate excessive permissions. It significantly reduces the organization's attack surface by eliminating unnecessary access.
- ✗
Provisioning
Why it's wrong here
Provisioning is the initial process of granting users access to systems, applications, and network resources based on their defined roles and responsibilities within an organization. This typically occurs when a new employee joins or an existing employee's role expands, establishing their baseline set of permissions. It focuses on the initial setup and allocation of access, rather than the subsequent, ongoing validation of those rights.
Go deeper
Related to this question
About these practice questions
This CISSP question is part of Courseiva's 816-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.