What is the purpose of deprovisioning access when an employee leaves?

• A. To remove credentials and prevent unauthorized access.
• B. To assign new roles to departing employees.
• C. To increase access for the next role.
• D. To archive the employee's personnel file.

Answer: (A)

When someone leaves, the security goal is to prevent any further access by removing their credentials and disabling their accounts. Deprovisioning ensures that passwords are changed, user accounts are disabled, access badges are deactivated, and devices are returned or wiped as needed. This immediate action closes the security gap, reducing the risk of data breaches, unauthorized entry, or misuse by a former employee. It also helps enforce policy and compliance by applying the same rule to all offboarding.

Other actions described wouldn’t fit this moment: assigning new roles or increasing access for a departing person makes no sense since they are leaving, and archiving the personnel file is a paperwork task rather than an access-control measure.