A security administrator is responsible for performing periodic reviews of user permission settings due to high turnover and internal transfers at a corporation. Which of the following BEST…

Reviewing all user permissions and group memberships against current job responsibilities ensures that only the minimum necessary access is maintained, directly implementing the principle of least privilege. High turnover and internal transfers create situations where users accumulate permissions from previous roles that are never revoked, increasing the organization's exposure to insider threats and data breaches. By periodically auditing and revoking excess permissions, the administrator reduces the potential blast radius of a compromised or malicious account.

Reviewing only transferred users addresses a subset of the problem but ignores permissions accumulated by users who have not recently transferred, leaving privilege creep unaddressed for a large portion of the user population.

Ensuring users have adequate permissions focuses on access sufficiency rather than access minimization, which contradicts the security rationale of least privilege and could result in over-provisioned accounts being left unchanged.

Focusing exclusively on former employee accounts addresses account termination procedures but ignores the broader privilege creep problem affecting active employees who have changed roles or accumulated excess rights over time.