At a regional hospital, front-desk clerks must create 24-hour guest accounts for visiting vendors, while only the IT service desk may extend, disable, or delete an account. Both teams work in the sponsor portal and an auditor reviews changes each week. Which sponsor group permission design enforces these role boundaries?
Select an answer to reveal the explanation.
Short Explanation
You keep the teams’ responsibilities separate through enforceable portal permissions, not just a promise about how staff will behave. In ISE, the sponsor group controls what each person can do, and the weekly audit gives you a trail to review.
Full Explanation
The correct design assigns permissions by responsibility: Front Desk can create 24-hour guest accounts, while only the Service Desk can modify or delete them. Separate sponsor groups enforce this boundary in the sponsor portal instead of relying on staff behavior or later review. Separate groups without enforced 24-hour expiry fail to ensure accounts end after the required lifetime. Giving Front Desk create-and-extend rights violates the rule that only the Service Desk may extend accounts, even if expiry is set. Using the identity console for Service Desk lifecycle changes shifts those actions outside the sponsor portal, although both teams work there and permissions should govern the workflow in that portal. Exam caveat: a weekly audit is a detective control, not a preventive permission boundary; it can reveal or help investigate changes but cannot stop an unauthorized role from making them. Practical check: test representative accounts to confirm Front Desk can create a guest with a 24-hour expiry but cannot extend, disable, or delete it, and Service Desk can perform its permitted lifecycle actions; verify the changes appear in the weekly audit record.