CISSP Identity and Access Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Deprovisioning

  Why it's wrong here

  Deprovisioning is the systematic process of revoking a user's access rights and associated resources when their employment terminates or their role changes significantly. This action is critical for security, ensuring that former employees or those no longer requiring specific access cannot exploit old permissions. It is a reactive measure triggered by an event, not a routine, proactive review of ongoing access appropriateness.

• ✗

  Separation of duties

  Why it's wrong here

  Separation of duties is a fundamental internal control designed to prevent fraud and error by ensuring that no single individual has complete control over all aspects of a critical transaction or process. It involves distributing responsibilities among multiple employees, requiring collusion to commit malicious acts. This principle focuses on task distribution rather than the periodic validation of user access permissions.

• ✓

  Recertification

  Why this is correct

  Recertification is the essential periodic process of formally reviewing and validating that users' current access rights and privileges remain appropriate and necessary for their assigned job functions. This proactive measure ensures adherence to the principle of least privilege over time, identifying and remediating instances of 'privilege creep' where users accumulate excessive permissions. It significantly reduces the organization's attack surface by eliminating unnecessary access.

• ✗

  Provisioning

  Why it's wrong here

  Provisioning is the initial process of granting users access to systems, applications, and network resources based on their defined roles and responsibilities within an organization. This typically occurs when a new employee joins or an existing employee's role expands, establishing their baseline set of permissions. It focuses on the initial setup and allocation of access, rather than the subsequent, ongoing validation of those rights.

Go deeper

Related to this question