A file server has thousands of permissions granted directly to individual user accounts. When employees change roles, their old permissions remain, and administrators cannot easily tell who should have what. Which approach BEST corrects this?
Select an answer to reveal the explanation.
Short Explanation
Handing out keys person by person is how you end up with a drawer full of mystery keys. Put the permissions on groups that match job roles, then move people in and out of groups. The trap is cloning a coworker's access - you inherit all their leftover junk too.
Full Explanation
Assigning permissions to groups that represent job roles, then managing membership, is the standard way to keep entitlements understandable and consistent. Administrators define what each role needs once, apply it to the group, and change a user's access by changing group membership when the role changes. Removing someone from the old group automatically strips the old permissions, which directly addresses privilege creep, and reviews become far easier because an auditor reviews a smaller number of group definitions and memberships. Continuing direct grants with a spreadsheet adds documentation but preserves the sprawl, and spreadsheets drift from reality quickly. Giving an entire department broad rights reduces exceptions by violating least privilege, granting many people access they do not need. Copying an existing employee's permissions, sometimes called mirroring, propagates whatever excess rights that person has accumulated, spreading creep rather than fixing it. Exam caveat: nested groups and exceptions should be minimized, since deep nesting recreates the visibility problem. Operational check: for one department, map current direct grants to a small set of role groups, migrate the users, remove the direct entries, and verify with each manager that the resulting access matches the job.