Exam CRISC topic 1 question 922 discussion

Question states: ensure user access is MAINTAINED on a least-privilege basis? - surely recertification of access is the most appropriate answer here? (B).

B. User recertification. User recertification is a process in which an organization regularly reviews and verifies the access rights and privileges of its users. This process helps ensure that users have only the access they need to perform their job functions, in line with the principle of least privilege. It involves checking and confirming that the access levels granted to users are still appropriate, and any unnecessary or excessive privileges are revoked. User recertification is a proactive and systematic approach to maintaining least privilege and reducing the risk of unauthorized access.

Agree with B. The answer at D is the start of the user journey, but recertification is the maintenance.

I join the herd with D

'B' is Correct.

D - User authorization is Correct.

D - User authorization is Correct. As a principle, least privilege falls under the second A in an information security framework known as AAA —authentication, authorization, and accounting (or accountability)

Agree with B

The correct answer is B. User access recertification is the process of continually auditing users' permissions to make sure they have access only to what they need.