SY0-701 Question 343
Single answer4.6 Given a scenario, implement and maintain identity and access management.A company is onboarding 150 temporary contractors for a six-week project. The contractors need access to a single project management application and a file repository, but they must not be able to access payroll, HR, or source code systems. The security team also wants all contractor accounts to expire automatically at the end of the engagement and to reduce the help desk workload for password resets. Which solution BEST meets these requirements?
- A
Create shared contractor accounts for each team and manually disable them when the project ends
- B
Provision individual accounts through the organization's IAM system, place users in a contractor role/group with least-privilege access, configure account expiration dates, and enable self-service password reset with MFA
- C
Add contractors to the same groups as full-time employees so they can work without access issues, then rely on managers to report accounts that should be disabled
- D
Require contractors to use privileged accounts so they can access any system they might need during the project, and review logs weekly for misuse
Show answer and explanation
Correct answer: B
Explanation
The best answer is to use centralized IAM processes to provision individual contractor identities with role-based access limited to only the required systems, while also setting automatic expiration for the engagement period. This aligns with standard IAM practices in Security+ domain 4.6, including identity lifecycle management, provisioning/deprovisioning, least privilege, role-based access control (RBAC), and self-service password management. Shared accounts and overprivileged access are common real-world mistakes because they seem convenient, but they undermine auditing, accountability, and access governance. Industry best practices from sources such as NIST SP 800-53 emphasize account management, least privilege, separation of duties, and timely disabling of accounts when no longer needed. NIST SP 800-63 also supports stronger identity assurance and secure authentication-related processes such as MFA-enabled recovery.
- A. Incorrect.
This is incorrect because shared accounts violate accountability and non-repudiation principles. With shared credentials, actions cannot be reliably tied to an individual user, which is a major IAM weakness. Manual deprovisioning is also error-prone and increases the risk of orphaned accounts remaining active after the project ends.
- B. Correct.
This is correct because it applies core IAM best practices: unique identities for each contractor, role-based or group-based access control, least privilege, automated provisioning/deprovisioning through account expiration, and self-service password reset to reduce administrative overhead. Requiring MFA for password reset also helps protect the recovery process from abuse.
- C. Incorrect.
This is incorrect because assigning contractors to employee groups violates least privilege and likely grants excessive access. Depending on managers to report accounts for removal is not a strong lifecycle management control and often results in delayed deprovisioning, which increases the risk of unauthorized access after the contract period.
- D. Incorrect.
This is incorrect because privileged accounts should be tightly controlled and only assigned when required for administrative duties. Giving contractors broad privileged access contradicts least-privilege principles and significantly increases the organization's attack surface. Log reviews are detective controls and do not replace proper preventive IAM controls.