(ISC)2 Certified in Cybersecurity Practice Exam

What should happen in an emergency workflow scenario upon unexpected user termination?

1. Schedule a meeting

2. Disable accounts immediately

3. Audit user activities

4. Notify other users

The correct answer is: Disable accounts immediately

In the event of an unexpected user termination, it is critical to disable the user’s accounts immediately to prevent unauthorized access to sensitive data and systems. This action helps to mitigate risks associated with potential insider threats or data breaches that could occur if the user retains access after their termination. Disabling accounts prevents the terminated user from logging in and accessing confidential information, which is essential for maintaining the integrity and security of the organization's data. This step is part of a broader access management strategy that ensures that the principle of least privilege is upheld, meaning that users should only have access to the information and systems necessary for their roles, and no more. The other options, while relevant in the context of workflow and incident response, do not directly address the immediate need to secure the systems. Scheduling a meeting, auditing user activities, and notifying other users are proactive measures that could follow the account disabling, but they do not address the urgent requirement to cut off access as a primary response to an unexpected termination. Providing immediate protection through account disablement is a crucial step in safeguarding the organization's information security posture.