SY0-701 Question 344
Single answerProvisioning/de-provisioning user accountsA company discovers that a recently terminated employee was still able to sign in to a cloud-based file-sharing platform several hours after HR marked the employee as separated. The security administrator finds that the user's identity provider account was disabled, but the file-sharing account remained active because it was managed locally within the application. The company wants to reduce the chance of this happening again while ensuring managers can quickly onboard new hires with the correct access. Which action would BEST address both the provisioning and de-provisioning weaknesses described in this scenario?
- A
Implement automated identity lifecycle management tied to HR status changes, with centralized provisioning and de-provisioning for connected applications
- B
Require managers to submit onboarding and termination requests by email so the security team has a manual approval record
- C
Increase password complexity requirements for all users of the file-sharing platform and rotate service account credentials quarterly
- D
Perform a quarterly user access review for all business applications and remove terminated users during the review cycle
Show answer and explanation
Correct answer: A
Explanation
The best answer is to implement automated identity lifecycle management using HR as the authoritative source and centrally managing provisioning and de-provisioning across integrated applications. In real environments, relying on separate local application accounts often leads to orphaned accounts when an employee leaves. Security best practices emphasize timely deactivation of accounts upon termination, least privilege, and standardized joiner-mover-leaver workflows. Common enterprise approaches include identity governance and administration (IGA), SCIM-based provisioning where supported, and single sign-on plus centralized account lifecycle controls. Quarterly reviews and manual approvals can supplement the process, but they should not replace immediate de-provisioning. This aligns with common guidance from NIST identity and access management practices, including controlling account creation, modification, disabling, and removal through formal, automated processes where possible.
- A. Correct.
Correct. Automated identity lifecycle management integrated with an authoritative source such as HR is a best-practice control for joiner, mover, and leaver processes. Centralized provisioning and de-provisioning helps ensure accounts are created with appropriate access when users are hired and disabled promptly across connected systems when employment ends. This directly addresses the gap in the scenario, where disabling the identity provider account did not disable the locally managed application account.
- B. Incorrect.
Incorrect. Email-based requests are slower, error-prone, and depend on humans consistently following process. While approval records can be useful, this approach does not solve the core issue of disconnected account stores or delayed de-provisioning. It also does not reliably improve rapid, accurate onboarding.
- C. Incorrect.
Incorrect. Stronger passwords and service account rotation are important security practices, but they do not address orphaned user accounts left active after termination. The scenario is about account lifecycle management, not weak authentication controls on existing accounts.
- D. Incorrect.
Incorrect. Periodic access reviews are useful detective controls and can identify excess or stale access, but a quarterly review leaves a large window of exposure. The scenario requires a preventive improvement that supports timely onboarding and immediate de-provisioning rather than delayed cleanup.