CompTIA Security+ (SY0-701)Security OperationsEasy
An employee resigns and their last day is today. Which action should the IT department prioritize as part of the offboarding process?
- ADisable the employee's user account and revoke access immediately
- BReassign the employee's manager approval rights
- CArchive the employee's email for future reference
- DSchedule a password reset for next quarter
Show answer & explanationAnswer & explanation
Correct answer: A. Disable the employee's user account and revoke access immediately
Immediately disabling the account and revoking access prevents unauthorized use of credentials after employment ends, which is the primary security control in offboarding.
Why the other options are wrong
- B. Reassigning approval rights is a business continuity task, not the immediate security priority.
- C. Archiving email is a secondary administrative task, not the priority security action.
- D. Delaying credential revocation leaves a security gap.
Account Deprovisioning
The process of disabling or removing a user's access rights when they no longer require them, such as at termination.
- Should occur immediately upon termination
- Prevents insider threat from former employees
- Part of the identity lifecycle management process
Memory trick: Last day, lock the door right away.