A quarterly IAM review for a city internship program finds dozens of dormant accounts that still have portal access months after interns left. What control practice does this finding primarily reinforce?
Select an answer to reveal the explanation.
Short Explanation
Interns leave; their logins sometimes do not. A quarterly who-still-has-keys walkthrough is an access review—catch dormant accounts before they become free souvenirs for attackers.
Full Explanation
Periodic account access reviews (recertification) require managers or system owners to attest that entitlements remain appropriate and to revoke what is not. Discovering dozens of dormant internship accounts that still reach city portals months after departure is direct evidence that joiner–mover–leaver outcomes and unused access must be examined on a schedule, not assumed correct after initial provisioning. Reviews catch orphaned human accounts, stale roles, and inappropriate standing privileges before attackers inherit them.
Increasing password complexity only for active administrators does nothing for dormant intern identities that never log in yet remain valid. Replacing all MFA tokens because dormancy exists misdiagnoses the failure mode—dormancy is an entitlement-lifecycle problem, not proof that hardware factors were phished. Disabling logging to reduce tickets from dormant accounts hides the signal that should drive cleanup and weakens investigative capability.
Exam caveat: access reviews complement automated deprovisioning; neither fully replaces the other when HR feeds are late or exceptions linger. Operational check: define review cadence by risk (interns and contractors more often), auto-flag accounts with no login for N days, require owner attestation with deadlines, and measure time-to-revoke after a negative review for the internship program and similar temporary workforces.