220-1102 Question 353
Single answerIdentity access management (IAM)A company hired several temporary employees for a 3-month project. The help desk created standard user accounts for them, but management is concerned that the contractors can still access shared folders and cloud applications after the project ends if someone forgets to disable the accounts. The company wants a solution that reduces this risk while still allowing the temporary staff to do their jobs during the project. Which of the following is the BEST IAM control to implement?
- A
Create time-of-day login restrictions for the temporary employees' accounts
- B
Assign the temporary employees to a group with only the required permissions and configure account expiration dates
- C
Require the temporary employees to change their passwords every week
- D
Give the temporary employees local administrator rights so they can install any needed applications
Show answer and explanation
Correct answer: B
Explanation
The best answer is to place the temporary employees in an appropriately scoped group and set account expiration dates. In IAM, identity lifecycle management is critical: accounts should be provisioned with the minimum necessary access and deprovisioned promptly when no longer needed. This aligns with common security best practices such as least privilege and timely removal of access for departing users or contractors. In Microsoft Active Directory environments, account expiration is a standard control for temporary users, and using groups simplifies permission assignment and auditing. Guidance from sources such as NIST emphasizes controlling account management, limiting privileges, and disabling or removing accounts when no longer required.
- A. Incorrect.
This is incorrect. Time-of-day login restrictions can limit when users sign in, but they do not address the main risk in the scenario: lingering access after the 3-month project ends. A contractor account could still remain active indefinitely unless someone manually disables it. This option partially limits access but does not provide the most effective lifecycle control for temporary accounts.
- B. Correct.
This is correct. Assigning temporary users to a group with only the permissions required follows the principle of least privilege, a core IAM best practice. Configuring account expiration dates directly addresses the concern that accounts may remain active after the contract period. This combines proper authorization management with automated account lifecycle control, making it the best fit for the scenario.
- C. Incorrect.
This is incorrect. Frequent password changes do not solve the issue of accounts remaining active after employment ends. Even if passwords are changed regularly, an account that is still enabled can still be used by the contractor or abused by someone else. This reflects a common misconception that stronger authentication alone solves account management problems.
- D. Incorrect.
This is incorrect. Local administrator rights violate least privilege and increase security risk. Temporary employees should receive only the access needed to perform their tasks. Granting administrative rights broadens access unnecessarily and does nothing to ensure the accounts are automatically deprovisioned when the project ends.