Master the IT-English vocabulary of access reviews and audits: entitlements, recertification, orphaned accounts and segregation of duties.
0 / 18 completed
1 / 18
An access review checks each user's 'entitlements'. What are entitlements?
Entitlements are the access rights (permissions, roles, resources) assigned to a user.
2 / 18
Managers must 'recertify' access quarterly. What does recertification mean?
Recertification (attestation) is the periodic confirmation that existing access is still appropriate.
3 / 18
The audit finds 'orphaned accounts'. What are they?
Orphaned accounts belong to people who have left or have no owner, posing a security risk.
4 / 18
'Segregation of duties' prevents what?
Segregation of duties splits sensitive tasks so no single person can both perform and approve a risky action.
5 / 18
Which sentence correctly uses 'least privilege' in an access review?
Least privilege means users hold only the access they need; reviews trim anything excessive.
6 / 18
John from the DevOps team flagged a potential security risk during the access review. He noted that Sarah, a junior developer, had read/write access to the production database for a project she hadn't worked on in six months. Which principle is John primarily addressing?
Least privilege dictates that users should only have the minimum access required to perform their tasks. John is highlighting that Sarah's excessive permissions are a deviation from this principle, potentially increasing risk if she were compromised or made an error. Data immutability and defense in depth relate to broader security strategies, while regular audits are a process for *enforcing* these principles.
7 / 18
Maria, the Security Architect, sent this Slack message to the team: 'Hey all, just letting you know we're running an audit of user access. Please ensure all your permissions are justified and documented. Let's maintain a secure environment!' What is Maria primarily requesting?
Maria is asking for *justification* – a documented rationale for why each user has the permissions they possess. This is crucial for an access review's audit trail and demonstrates accountability. A risk assessment would be a separate activity, a system shutdown isn't appropriate during an audit, and a backup is standard operational procedure.
8 / 18
API Response:
```json
{
"status": "success",
"user": {
"id": "789456",
"role": "administrator",
"last_accessed": "2023-10-26T10:00:00Z"
}
}
```
Based on this API response, what does the 'administrator' role likely represent in terms of access review?
The 'administrator' role, as indicated by the API response, likely implies a broad level of privileges. Access reviews are often triggered when high-level roles like administrator are identified, signifying potential over-permissioning. While administrators *should* be subject to regular review, this response focuses on the inherent access granted by the role itself.
9 / 18
During a standup meeting, David says: 'I've been reviewing my access and realized I still have read access to the customer support database. My role doesn't require this, so I'm requesting it be removed.' What is David doing in this scenario?
David is actively *implementing* the principle of least privilege by requesting permissions that are no longer necessary for his job function. This proactive step directly addresses a potential security risk and demonstrates an understanding of access control best practices. Escalating a vulnerability or requesting a formal audit would be subsequent actions based on this initial correction.
10 / 18
John from the DevOps team flagged a potential security risk during the access review. He noted that Sarah, a junior developer, had read/write access to the production database for a project she hadn't worked on in six months. Which principle is John primarily addressing?
Least privilege dictates that users should only have the minimum access required to perform their tasks. John is highlighting that Sarah's excessive permissions are a deviation from this principle, potentially increasing risk if she were compromised or made an error. Data immutability and defense in depth relate to broader security strategies, while regular audits are a process for *enforcing* these principles.
11 / 18
Maria, the Security Architect, sent this Slack message to the team: 'Hey all, just letting you know we're running an audit of user access. Please ensure all your permissions are justified and documented. Let's maintain a secure environment!' What is Maria primarily requesting?
Maria is asking for *justification* – a documented rationale for why each user has the permissions they possess. This is crucial for an access review's audit trail and demonstrates accountability. A risk assessment would be a separate activity, a system shutdown isn't appropriate during an audit, and a backup is standard operational procedure.
12 / 18
API Response:
```json
{
"status": "success",
"user": {
"id": "789456",
"role": "administrator",
"last_accessed": "2023-10-26T10:00:00Z"
}
}
```
Based on this API response, what does the 'administrator' role likely represent in terms of access review?
The 'administrator' role, as indicated by the API response, likely implies a broad level of privileges. Access reviews are often triggered when high-level roles like administrator are identified, signifying potential over-permissioning. While administrators *should* be subject to regular review, this response focuses on the inherent access granted by the role itself.
13 / 18
During a standup meeting, David says: 'I've been reviewing my access and realized I still have read access to the customer support database. My role doesn't require this, so I'm requesting it be removed.' What is David doing in this scenario?
David is actively *implementing* the principle of least privilege by requesting permissions that are no longer necessary for his job function. This proactive step directly addresses a potential security risk and demonstrates an understanding of access control best practices. Escalating a vulnerability or requesting a formal audit would be subsequent actions based on this initial correction.
14 / 18
During an access review, the team identified that Alex has 'unrestricted' access to the company's internal build server. What does 'unrestricted' typically mean in this context? It means Alex can perform any action on the server, including deploying code without approval.
'Unrestricted' access implies a lack of limitations or controls. In an access review, it usually signifies that the user has broad permissions allowing them to perform almost any operation on the system, potentially increasing security risks if misused. This contrasts with 'limited' or 'controlled' access which restricts actions.
15 / 18
Maria, a Senior Developer, is explaining the concept of 'least privilege' to a new team member. Which statement best describes Maria's explanation? 'Least privilege' means users should only have the minimum access necessary to perform their job duties, minimizing potential damage from compromised accounts or insider threats.
'Least privilege' is a fundamental security principle. It restricts users to only the necessary resources and permissions, reducing the blast radius of a potential breach. It's about minimizing risk by preventing excessive access.
16 / 18
The security team is reviewing user access logs and identifies several 'dormant accounts'. What do these terms mean? 'Dormant accounts' refer to user accounts that haven't been accessed for an extended period (typically 90 days or more) and are therefore considered inactive and potentially vulnerable.
Dormant accounts represent a security risk because they often haven't been updated with current security policies or best practices. They also may not be actively monitored, making them easy targets for attackers. Regular review and eventual disabling of these accounts are crucial.
17 / 18
During a code review discussion, David points out that Sarah has access to the production database via a legacy application. He argues this violates the principle of 'separation of duties'. What does 'separation of duties' aim to achieve? 'Separation of duties' ensures that no single person controls all aspects of a critical process (like database administration), preventing fraud, errors, and abuse of power.
Separation of duties is a key control to mitigate risk. By assigning different responsibilities to separate individuals, it reduces the likelihood of errors or malicious actions going undetected. It's about checks and balances within an organization.
18 / 18
A PR description for a new feature includes the following statement: 'This change grants the user full access to the API endpoints.' Which of the following best describes what this means in terms of an access review? Granting 'full access' suggests that the user's permissions are not appropriately limited, potentially violating the principle of least privilege and increasing security risks.
'Full access' is too broad and doesn't align with security best practices. It implies no restrictions on what actions a user can perform, which creates unnecessary vulnerabilities. A more precise description should clearly define the scope of permissions.
Master the IT-English vocabulary of access reviews and audits: entitlements, recertification, orphaned accounts and segregation of duties.
How many exercises are in this module?
This module has 18 multiple-choice exercises, each with instant feedback and a full explanation of the correct answer.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall.
Do I need to create an account to do these exercises?
No account is required. Just click an option to answer — your score for this session is tracked automatically in the progress bar above.
What happens if I choose the wrong answer?
You'll immediately see which answer was correct, plus a full explanation covering the vocabulary and reasoning behind it — mistakes are where most of the learning happens.
Can I retry the exercises if I want a higher score?
Yes — use the "Try again" button on the results screen to reset and go through all the questions again.
Is my progress saved if I close the page?
No. Progress is tracked only for your current visit; reloading or leaving the page resets the counter. This keeps the exercise simple and account-free.
Where can I find more Identity & Access Management exercises?
Browse the full Identity & Access Management hub for related drills, or check the "Next up" link below to continue with a connected topic.
How is this different from reading an article on the same topic?
Articles explain vocabulary and concepts in prose; this exercise tests and reinforces that vocabulary through active recall with immediate feedback — the two work best together.
Who writes these exercises?
Every exercise is written by the CoderSlingo team, drawing on real workplace English used in IT roles, then reviewed for accuracy and clarity.