Which practice involves reviewing user accounts for dormant status, excessive privileges, default credentials, orphaned accounts, non-expiring passwords, shared accounts, and irregular login times?

• A. Access Control
• B. Identity Management
• C. User Provisioning
• D. Auditing of System Accounts

Answer: (D)

Auditing of system accounts focuses on examining existing user accounts and their attributes to uncover security gaps and ensure policy compliance. By reviewing for dormant status, you catch accounts that are no longer needed but still have access, reducing the attack surface. Checking for excessive privileges helps prevent privilege creep where users accumulate more access than necessary. Flagging default credentials and non-expiring passwords strengthens authentication, while identifying orphaned or shared accounts improves accountability and reduces gaps in ownership. Noting irregular login times can reveal suspicious or inappropriate activity. Together, these checks keep account hygiene aligned with actual use and policy.

This practice differs from access control, which defines who can access what and under what conditions, and from identity management, which handles the lifecycle of identities and credentials. It also differs from user provisioning, which is about creating and deactivating accounts as people join or leave. Auditing of system accounts is the ongoing verification that enforcement and lifecycle processes are working properly, by reviewing the accounts themselves and their behavior.