SSCP Access Controls Practice Question
A security auditor is reviewing the account lifecycle process. Which TWO of the following are mandatory steps during the deprovisioning (offboarding) process?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Preserve evidence for potential investigation
Immediate disabling prevents unauthorized access, and preserving evidence (logs, files) is essential for potential investigations. Deleting accounts immediately may hinder forensics, and notifying users is not required (they are leaving).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Preserve evidence for potential investigation
Why this is correct
Evidence must be preserved.
- ✗
Change the user's password to a default
Why it's wrong here
Disabling is sufficient; changing password may not be necessary.
- ✓
Immediately disable the account
Why this is correct
Disabling prevents access immediately.
- ✗
Notify the user that their account will be removed
Why it's wrong here
The user is leaving; notification is not a security step.
- ✗
Delete the account and all associated data
Why it's wrong here
Deleting evidence may be premature; preservation is needed first.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 920 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SSCP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. What is the primary purpose of account deprovisioning in the account lifecycle?
easy- A.To modify user roles and permissions
- ✓ B.To immediately disable accounts and preserve evidence
- C.To enforce password policies
- D.To create new user accounts
Why B: Deprovisioning ensures that when an employee leaves, access is revoked immediately to prevent unauthorized use, and evidence is preserved for investigations.
Variation 2. What is the primary purpose of account deprovisioning?
easy- ✓ A.To revoke access and disable accounts when no longer needed
- B.To create new user accounts
- C.To audit user activity
- D.To modify user roles
Why A: Deprovisioning ensures that when an employee leaves or changes roles, access is removed promptly to prevent unauthorized use.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.