A contractor's engagement ended six months ago, but the contractor's VPN account is still active and was used last night from an unfamiliar address. Which vulnerability does this illustrate, and which control addresses it?
Select an answer to reveal the explanation.
Short Explanation
An account nobody's watching is a key nobody remembers handing out. When the contract ended, that VPN login should have died with it. You fix the process, not just the account: offboarding tied to end dates, and regular reviews that catch what slipped through.
Full Explanation
Unmanaged or stale credentials are accounts and secrets that remain valid after their legitimate purpose has ended, such as accounts belonging to former employees, finished contractors or retired services. They are attractive to attackers because nobody expects activity on them, so misuse can go unnoticed, and the original owner is no longer bound by employment controls. A contractor account still active six months after the engagement ended, now used from an unfamiliar address, is a direct example. The corrective controls are deprovisioning workflows triggered by contract end dates and periodic access reviews that confirm every account still has an owner and a business need. Shadow IT concerns unapproved services adopted by staff, not leftover accounts in an approved system. Privilege creep is the accumulation of excess permissions by active users who change roles; the issue here is an account that should not exist at all. Weak passwords may contribute to compromise, but even a perfect password on an account that should have been removed still leaves the exposure in place. Exam caveat: automated provisioning tied to the authoritative HR or vendor record is the preferred fix. Operational check: disable the account, review its sessions and accessed resources since the engagement ended, and search for other accounts with no current owner.