When selecting a sample of users terminated in the past six months, what should you verify?

When selecting a sample of users terminated in the past six months, what should you verify?

• A. Their IDs have been deactivated or removed from access lists
• B. They have passwords that never expire
• C. They should be re-added to the access list after changes
• D. Their accounts have been renamed for clarity

Answer: (A)

The essential idea here is to confirm proper deprovisioning: when someone leaves, their ability to access systems must be removed. By checking that the IDs of users terminated in the past six months have been deactivated or removed from access lists, you verify that authentication rights were actually revoked across the environment. This is how you enforce the principle that former employees or contractors should no longer be able to sign in or access data, reducing the risk of unauthorized use. Keeping passwords that never expire would leave active credentials even after termination, which is unsafe and contradicts lifecycle management. Re-adding terminated users to the access list after changes would regrant access, defeating the purpose of termination. Renaming accounts for clarity doesn’t stop access or revoke permissions, so it doesn’t fulfill the deprovisioning requirement. In short, the best check is to ensure each terminated user’s account is disabled or removed from all access paths, confirming that access rights were properly revoked as part of the offboarding process.

The essential idea here is to confirm proper deprovisioning: when someone leaves, their ability to access systems must be removed. By checking that the IDs of users terminated in the past six months have been deactivated or removed from access lists, you verify that authentication rights were actually revoked across the environment. This is how you enforce the principle that former employees or contractors should no longer be able to sign in or access data, reducing the risk of unauthorized use.

Keeping passwords that never expire would leave active credentials even after termination, which is unsafe and contradicts lifecycle management. Re-adding terminated users to the access list after changes would regrant access, defeating the purpose of termination. Renaming accounts for clarity doesn’t stop access or revoke permissions, so it doesn’t fulfill the deprovisioning requirement.

In short, the best check is to ensure each terminated user’s account is disabled or removed from all access paths, confirming that access rights were properly revoked as part of the offboarding process.