When an employee is terminated from his or her job, what should be the next immediate step taken by an organization?

Question

Options

• AThe organization should monitor the activities of the system administrators and privileged users
• BThe organization should enforce separation of duties
• CThe access requests granted to an employee should be documented and vetted by the supervisor
• DAll access rights of the employee to physical locations, networks, systems, applications and data

• A
  6% (3)
• B
  2% (1)
• C
  2% (1)
• D
  90% (45)

Explanation

Revoking all access rights (D) is the immediate priority because a terminated employee retains the ability to cause harm - intentional or accidental - until every access vector is closed: badge access, VPN credentials, application logins, and data permissions must all be disabled simultaneously to eliminate insider threat risk.

Why the distractors are wrong:

• A (monitoring admins) addresses an unrelated concern about privileged user oversight, not termination response.
• B (separation of duties) is a preventive control applied during employment, not a termination procedure.
• C (documenting access requests) describes the provisioning process when an employee is hired, not offboarded.

Memory tip: Think of termination like revoking a hotel key card - the very first thing the hotel does is deactivate the card, not review who gave it out or watch the front desk staff. Access revocation always comes first.

No community discussion yet for this question.