Which of the following controls will BEST mitigate risk associated with excessive access privileges?

Review of user access logs helps detect *misuse* of privileges but does not prevent the existence of excessive privileges in the first place.

Frequent password expiration is a control for authentication strength, not directly for mitigating the risk of users having too many privileges once authenticated.

Separation of duties prevents a single individual from completing a critical task end-to-end, reducing the risk of fraud or error, but it doesn't directly address the granularity of individual user privileges.

Entitlement reviews, also known as access reviews or user access certifications, involve systematically examining and verifying that each user's assigned access privileges are appropriate and necessary for their current job function. This process directly identifies and rectifies instances of excessive access, dormant accounts, or outdated permissions, ensuring the principle of least privilege is maintained and thereby mitigating the risk of unauthorized access due to over-privileging.