A smart-city pilot ends, yet project AD groups and API keys still grant access to IoT dashboards. What should IAM operations prioritize?
Select an answer to reveal the explanation.
Short Explanation
Projects die; their group memberships sometimes keep the lights on for strangers. Hunt orphaned access—accounts and keys with no living owner or project—and shut them off.
Full Explanation
When a smart-city pilot ends, project AD groups, contractor accounts, and API keys often outlive the initiative. IAM operations should prioritize detecting and removing that orphaned access so IoT dashboards and related APIs are no longer reachable through abandoned entitlements. Orphan cleanup is a lifecycle and review problem: map owners, attest necessity, revoke what has no active business sponsor, and rotate or delete leftover secrets.
Extending every project account password expiration by another year prolongs stale access instead of ending it. Publishing API keys in the open-data portal confuses transparency of public datasets with exposure of credentials and invites immediate abuse of the dashboards. Merging all project groups into Domain Users “to simplify nesting” broadens access to a default population and erases the isolation the project groups once attempted to provide.
Exam caveat: closed projects are classic orphan factories—look for deprovisioning and entitlement removal, not password-policy theater. Operational check: tag project-scoped groups and keys with an end date at creation, run post-closure reviews within a fixed number of days, verify IoT dashboard auth no longer accepts retired clients, and record destruction or rotation of API secrets in the change log.