For a sample of user IDs, which testing step verifies proper privilege enforcement?

For a sample of user IDs, which testing step verifies proper privilege enforcement?

• A. Verify that each user ID has the same privileges
• B. Confirm that all user IDs have the same privileges as the administrator
• C. Ensure that privilege assignments are reviewed monthly regardless of role
• D. Verify that each user ID and privileged user ID has been implemented with only the privileges specified on the documented approval

Answer: (D)

The step being tested is all about enforcing access exactly as approved. When you sample user IDs, you want to check that the privileges actually granted to each ID—and to any privileged IDs—match exactly what is documented as approved. This ensures the organization follows the least-privilege principle and avoids privilege creep, where users accumulate more rights than they should over time. In practice, you compare the current privileges assigned to each sampled ID with the documented approval for those IDs. If any ID has more privileges than what was approved, that indicates a gap in enforcement and potential risk. Why the other ideas don’t fit: simply ensuring everyone has the same privileges ignores the reality that different roles require different access. Saying all IDs should have the same privileges as the administrator is not correct because administrators typically need broader rights, while regular users do not. Monthly reviews are important, but they are about recertification timing, not verifying that each ID’s privileges precisely match the documented approvals for every sample.

The step being tested is all about enforcing access exactly as approved. When you sample user IDs, you want to check that the privileges actually granted to each ID—and to any privileged IDs—match exactly what is documented as approved. This ensures the organization follows the least-privilege principle and avoids privilege creep, where users accumulate more rights than they should over time.

In practice, you compare the current privileges assigned to each sampled ID with the documented approval for those IDs. If any ID has more privileges than what was approved, that indicates a gap in enforcement and potential risk.

Why the other ideas don’t fit: simply ensuring everyone has the same privileges ignores the reality that different roles require different access. Saying all IDs should have the same privileges as the administrator is not correct because administrators typically need broader rights, while regular users do not. Monthly reviews are important, but they are about recertification timing, not verifying that each ID’s privileges precisely match the documented approvals for every sample.