How are access reviews conducted and why?

• A. Randomly verify permissions.
• B. Only review during onboarding.
• C. Never change permissions.
• D. Periodically verify and adjust user permissions to remove unnecessary or excessive access.

Answer: (D)

Periodic access reviews verify who has access to systems and what level of access they possess, with the goal of keeping permissions aligned with current needs. This approach maintains the principle of least privilege by removing unnecessary or excessive permissions and by promptly de-provisioning access when someone changes roles or leaves. Regular reviews also help prevent privilege creep, where permissions accumulate over time and create risk, and they support evidence-based compliance by providing attestation of access.

Why this works best: access can drift as people shift roles, complete projects, or exit the organization, so reviews at regular intervals ensure changes are caught and corrected. Automation and defined schedules make the process consistent and auditable, reducing the chance of hidden over-privilege.

Why the other options don’t fit: random checks don’t reliably catch drift; reviewing only at onboarding misses changes that happen afterward; and never changing permissions ignores the dynamic nature of roles and can leave risky, outdated access in place.