Which of the following violates identity and access management best practices?

User accounts are a standard, recommended IAM construct that assigns unique credentials to individual users, fully supporting accountability and access control policies.

System accounts are legitimate IAM components used by services and applications to perform automated tasks; while they require careful management, their use is an accepted and necessary practice.

Generic accounts (e.g., 'admin', 'guest', or shared departmental accounts) violate IAM best practices because they lack individual accountability - multiple people can use the same credentials, making audit trails and forensic investigations unreliable. IAM best practices mandate that every user have a unique, identifiable account so that all actions can be traced back to a specific person. This principle of non-repudiation and least-privilege assignment is impossible to enforce with shared generic accounts.

Privileged accounts, while requiring extra controls such as PAM solutions and just-in-time access, are a recognized and necessary IAM category for administrative tasks and do not inherently violate best practices.