Which action best describes immediate revocation of access for terminated users?

Which action best describes immediate revocation of access for terminated users?

• A. Deactivate or remove the user’s access only during annual reviews
• B. Revoke access for terminated users at the end of the quarter
• C. Suspend accounts temporarily for security incidents
• D. Immediately revoke access for terminated users and deactivate credentials

Answer: (D)

Immediate deprovisioning of terminated users is essential because once someone leaves, any lingering access creates a real window for unauthorized activity. Revoking all credentials and disabling accounts across all systems—network, applications, databases, VPN, SSO, and any physical access controls—right away stops potential data exposure and aligns with strong access control practices. Delaying until a quarterly or annual review leaves that window open and increases risk, while temporarily suspending accounts is not sufficient for a terminated user since the intent is permanent removal of access.

Immediate deprovisioning of terminated users is essential because once someone leaves, any lingering access creates a real window for unauthorized activity. Revoking all credentials and disabling accounts across all systems—network, applications, databases, VPN, SSO, and any physical access controls—right away stops potential data exposure and aligns with strong access control practices. Delaying until a quarterly or annual review leaves that window open and increases risk, while temporarily suspending accounts is not sufficient for a terminated user since the intent is permanent removal of access.