Which action best aligns with cloud security policy when decommissioning user accounts in a cloud environment?

Which action best aligns with cloud security policy when decommissioning user accounts in a cloud environment?

• A. Wait for a quarterly cycle to disable accounts.
• B. Initiate account disablement and ensure completion within four hours.
• C. Disable accounts only during routine maintenance windows.
• D. Reboot identity services daily to commit disablements.

Answer: (B)

Prompt and timely decommissioning of user accounts is essential in cloud security. When a user leaves or no longer should have access, their credentials and permissions must be revoked quickly to close the window for potential misuse. Initiating disablement and ensuring it’s completed within a short, defined timeframe (such as four hours) puts access revocation on a clear schedule, helping to automatically revoke tokens, sessions, and IAM permissions across all connected services. This minimizes the risk of lingering access and supports proper auditing and compliance. Delaying until a quarterly cycle leaves a large vulnerability window, during which an offender or an attacker could still use active credentials. Handling decommissioning only during routine maintenance windows introduces unpredictability and the chance of missed steps. Rebooting identity services daily doesn’t actually remove access for a specific user and can cause unnecessary disruption, without guaranteeing timely deactivation. So, promptly initiating and completing account disablement within a tight SLA best aligns with standard cloud security practices for decommissioning.

Prompt and timely decommissioning of user accounts is essential in cloud security. When a user leaves or no longer should have access, their credentials and permissions must be revoked quickly to close the window for potential misuse. Initiating disablement and ensuring it’s completed within a short, defined timeframe (such as four hours) puts access revocation on a clear schedule, helping to automatically revoke tokens, sessions, and IAM permissions across all connected services. This minimizes the risk of lingering access and supports proper auditing and compliance.

Delaying until a quarterly cycle leaves a large vulnerability window, during which an offender or an attacker could still use active credentials. Handling decommissioning only during routine maintenance windows introduces unpredictability and the chance of missed steps. Rebooting identity services daily doesn’t actually remove access for a specific user and can cause unnecessary disruption, without guaranteeing timely deactivation.

So, promptly initiating and completing account disablement within a tight SLA best aligns with standard cloud security practices for decommissioning.