220-1102 Question 661
Single answerUser off-boarding checklistA help desk technician is assigned to off-board a sales employee whose employment ends today. The employee used a company laptop, had access to shared cloud storage, and used a company email account on a smartphone. Which action should the technician perform FIRST to best protect company data while following a proper user off-boarding checklist?
- A
Disable the user's account and revoke access to company resources
- B
Delete the user's mailbox to free up storage space
- C
Reimage the user's laptop before collecting it from the employee
- D
Remove the employee from the company directory after 30 days
Show answer and explanation
Correct answer: A
Explanation
A proper user off-boarding checklist prioritizes immediate access revocation before administrative cleanup or device reimaging. In a real-world A+ Core 2 context, the technician should disable the account, revoke access to email, cloud apps, VPN, and mobile-connected services, and then proceed with asset recovery, data retention/transfer, and final device sanitization based on company policy. Common off-boarding best practices include disabling accounts, collecting company-owned devices, removing access to shared resources, documenting returned assets, and preserving business data as required. These steps align with standard organizational security procedures and the principle of least privilege by ensuring former users no longer have access once employment ends.
- A. Correct.
Correct. Disabling the user's account and revoking access is the highest-priority first step in an off-boarding process because it immediately prevents further logins to email, cloud services, VPNs, and other company resources. This reduces the risk of intentional or accidental data loss after separation. In practice, this also supports related actions such as forcing sign-out, revoking tokens, and disabling remote access before the device is processed.
- B. Incorrect.
Incorrect. Deleting the mailbox is not the first step and may violate retention, legal hold, HR, or business continuity requirements. Best practice is to disable access first, then preserve or transfer data according to organizational policy. Someone might choose this option because it sounds like a quick way to cut access, but deleting data is not the same as revoking authentication.
- C. Incorrect.
Incorrect. Reimaging the laptop before collecting it is not appropriate because the organization should first secure the account and recover the asset. Reimaging too early could destroy evidence, remove needed business data, or interfere with asset tracking and chain-of-custody procedures. This distractor reflects the misconception that device sanitization should happen before access control and asset recovery.
- D. Incorrect.
Incorrect. Directory cleanup may be part of a later administrative process, but delaying action for 30 days does not address the immediate security risk. The priority during off-boarding is to stop access at once, then complete follow-up steps such as forwarding email, transferring files, documenting returned assets, and updating directory information according to policy.