During an access review, a group is found to hold permissions it no longer needs after a reorganisation. What is the correct action?
Select an answer to reveal the explanation.
Short Explanation
You revoke what's no longer justified so entitlement keeps matching current need. If you leave stale permissions alone, a small role can creep into reading everything, one reorg at a time.
Full Explanation
Revoking permissions that are no longer justified is correct because access reviews exist to bring entitlement back in line with current need. Identified excess should be revoked, with change control and notification if a workflow might be affected. Leaving permissions in place because removing access risks breaking an unknown workflow is wrong: fear of an unknown dependency is an argument for checking, not for permanent over-entitlement; on that logic nothing is ever removed. Converting permissions into administrator rights so the group can manage its own access is wrong because delegating administrative rights escalates rather than reduces privilege. Documenting the excess in the review record and revisiting at the next annual review is wrong because deferring known excess for a year leaves it in place for the entire period, which defeats the review. For the exam, the outcome of a review is remediation, not merely documentation.