Domain 5 · Objective reference 5.5 · Chapter 36 of 62
Provision, review, transfer and remove access
About 5 minutes · Current ISC2 outline effective 15 April 2024; the announced 15 April 2027 replacement requires separate mapping
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: New rights should replace obsolete rights not accumulate forever.
Explore the anchors
Approve and grant necessary access.
Concept matching activity
Match this task or description to its concept:
Reconcile rights with current roles.
Choose a concept before checking the explanation.
Access-decision sandbox
Try to edit a fictional record as a reader. Then change one condition and evaluate again. This simplified policy requires authentication, object scope and action permission; real policies have more conditions.
Change the request, then evaluate it.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What this chapter explains
- Concepts and mechanisms
- Design, evidence and tradeoffs
Concepts and mechanisms
Provisioning should follow approved role and purpose, with an owner and necessary permissions. Reviews evaluate effective access, including nested groups, local accounts, service identities and delegated application grants. Transfers need removal of obsolete or incompatible rights rather than simple accumulation. Non-human identities require ownership and credential lifecycle even without an employee departure event.
Design, evidence and tradeoffs
Deprovisioning covers relevant accounts, sessions, tokens, keys, remote access and physical access. A directory disable does not necessarily revoke every independent path. Privilege elevation should be controlled and attributable, with task scope, duration and after-use evidence. Use an authoritative population to test completeness; a sample of closed removal tickets cannot establish that every departure generated a ticket.
Worked example
A service account remains necessary after its sponsor leaves, so ownership and access are reviewed and transferred rather than abandoned.
Check your understanding
Why should access review inspect inherited rights?
Show explanation
Effective authority can exceed direct grants or friendly role names through nested memberships and combined policies.
Source and study boundary
Official syllabus source. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.