SY0-701 Question 342
Single answer4.6 Given a scenario, implement and maintain identity and access management.A company recently integrated its HR system with its identity provider so that employee status changes automatically trigger account updates. During an internal audit, the security team discovers that several former contractors still have active VPN and SaaS access for weeks after their contracts ended. The IAM administrator confirms that full-time employees are disabled automatically when HR marks them as terminated, but contractors are managed in a separate database that is updated manually by department managers. The company wants to reduce the risk of orphaned accounts without significantly increasing administrative overhead. Which action would BEST address this issue?
- A
Require all contractors to change their passwords every 30 days
- B
Integrate the contractor management data source with the identity lifecycle process so contractor end dates automatically trigger deprovisioning
- C
Move all contractor accounts into a shared generic account for each department
- D
Grant contractors access only during business hours through a time-of-day access control policy
Show answer and explanation
Correct answer: B
Explanation
This scenario focuses on identity and access management lifecycle controls, particularly provisioning and deprovisioning tied to an authoritative source. The key issue is orphaned accounts caused by a manual contractor offboarding process. The most effective and efficient remediation is to integrate contractor records into the same automated identity lifecycle workflow used for employees, or otherwise establish automated deprovisioning based on contract status/end date. This aligns with core IAM practices such as automated account management, least privilege, and timely removal of access. Guidance from common security frameworks and best practices, including NIST identity management principles and access control recommendations, supports using authoritative identity sources and automated joiner-mover-leaver processes to reduce the risk of unauthorized access from stale accounts.
- A. Incorrect.
Incorrect. More frequent password changes do not solve the core problem of orphaned accounts remaining active after a contractor leaves. If an account is still enabled, password rotation alone does not ensure timely revocation of access. This option reflects a common misconception that stronger authentication controls can compensate for weak account lifecycle management.
- B. Correct.
Correct. The best solution is to automate contractor provisioning and deprovisioning by integrating the contractor data source into the identity lifecycle workflow. This addresses the root cause: contractor accounts are not tied to an authoritative source for status changes. Automated deprovisioning based on contract end dates is a standard IAM best practice because it reduces human error, improves timeliness, and lowers administrative burden while enforcing least privilege and proper account management.
- C. Incorrect.
Incorrect. Shared generic accounts undermine accountability, auditing, and non-repudiation. Security best practices require unique identities for each user so actions can be traced to an individual. This option may seem administratively simpler, but it creates significant security and compliance issues and does not properly address identity governance.
- D. Incorrect.
Incorrect. Restricting access to business hours may reduce exposure somewhat, but it does not remove access after the contractor relationship ends. A former contractor could still connect during allowed hours if the account remains active. This is a compensating control at best, not the most effective fix for stale accounts.