SSCP Security Operations and Administration Practice Question
A security administrator is reviewing the account lifecycle process for a large retail company. An employee in the accounting department has been promoted to a role in the same department that requires access to the payroll system, while the employee's previous duties no longer require access to the accounts payable system. Which action should the administrator take to ensure least privilege is maintained?
⚠ Common exam trap
The trap here is assuming that a role change requires a new account or a full deprovisioning, when least privilege is achieved by adjusting entitlements on the existing identity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify the existing account to grant payroll access and remove the accounts payable access.
Because the employee remains with the organization but changed job duties, the account should be modified to add the payroll entitlement and remove the accounts payable entitlement. This maintains least privilege, preserves the identity history, and avoids both account sprawl and lingering unnecessary access. The other choices either retain excessive rights, create redundant identities, or disrupt a current employee's access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Modify the existing account to grant payroll access and remove the accounts payable access.
Why this is correct
Least privilege requires that an account hold only the access needed for current job duties. Since the employee remains with the company but changed roles, the existing identity should be retained and its entitlements adjusted by adding payroll access and removing accounts payable access. This keeps the account lifecycle accurate and prevents accumulation of unnecessary privileges.
- ✗
Disable the existing account and require the employee to request a new account through the help desk.
Why it's wrong here
Disabling the account of a current employee disrupts payroll and other legitimate access, and creating a new identity loses the account history tied to the original hire. The employee has not left the organization, so a full deprovisioning is inappropriate. The correct action is to modify entitlements on the existing account to reflect the new role while preserving the identity record.
- ✗
Create a new account for the payroll role and disable the old accounts payable account after 30 days.
Why it's wrong here
Creating a new account adds an unnecessary identity and leaves the old account active for 30 days, which violates least privilege by retaining unneeded access. Account sprawl also complicates auditing and increases the attack surface. The correct approach is to modify the existing account's role assignments so access matches the new job duties immediately, rather than delaying removal of the obsolete entitlement.
- ✗
Leave both sets of access in place so the employee can assist the accounting team during the transition.
Why it's wrong here
Retaining accounts payable access after the employee's duties no longer require it creates excessive privilege that could be misused or exploited if the account is compromised. Transition convenience is not a valid justification for violating least privilege. The access should be removed promptly, and any temporary need should be handled through a documented, time-bound exception rather than leaving standing entitlements.
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 971-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.