SSCP Access Controls Practice Question
What is the primary purpose of account deprovisioning?
⚠ Common exam trap
SSCP often tests the distinction between provisioning and deprovisioning, and candidates may confuse deprovisioning with auditing or role changes, leading them to select an incorrect option that describes a related but different IAM function.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To revoke access and disable accounts when no longer needed
Account deprovisioning is the process of removing or disabling user accounts and revoking associated access rights when they are no longer required, such as when an employee leaves the organization or changes roles. The primary goal is to ensure that former users cannot access systems, data, or resources, thereby reducing the attack surface and preventing unauthorized access. This is a fundamental control in identity and access management (IAM) and is required by regulations like SOX, HIPAA, and PCI DSS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
To revoke access and disable accounts when no longer needed
Why this is correct
Deprovisioning removes or disables identities and revokes their entitlements once employment or the business need ends, closing the standing access that could otherwise be abused. It is the lifecycle counterpart to provisioning, not a password or permission review.
- ✗
To create new user accounts
Why it's wrong here
Creating new user accounts is account provisioning, the opposite lifecycle phase; deprovisioning removes or disables access when employment or a contract ends. Provisioning is the right answer when onboarding staff, where directory objects, group memberships and licences must be created in Microsoft Entra ID. The stem asks for the primary purpose of deprovisioning, so account creation fails it.
- ✗
To audit user activity
Why it's wrong here
Auditing reviews recorded activity for compliance or investigation; deprovisioning actually removes or disables the identity and its access rights. Auditing tempts because it also concerns accounts, but it observes rather than revokes, leaving the account active.
- ✗
To modify user roles
Why it's wrong here
Deprovisioning removes or disables accounts and revokes their access; altering role assignments is permission management on an existing identity, not removal. Modifying roles tempts because it also changes what a user can reach, but the account itself persists.
Go deeper
Related to this question
About these practice questions
One of 971 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.