CISSP Practice Question: What would MOST likely happen if an organization fails to regularly review…

Correct Answer: A. Increased security risks

Explanation (CISSP Manager Logic):

Neglecting access reviews leads to privilege creep and unauthorized access by former employees or internal transfers. This failure violates the principle of least privilege, expanding the attack surface and increasing the likelihood of a high-impact data breach.

By performing regular reviews, you:

• Enforce least privilege by aligning permissions with current job roles.
• Maintain compliance with regulatory frameworks and audit requirements.
• Mitigate insider threats by revoking unnecessary or stale credentials.

While the other options are relevant, they fall short because:

• B: Productivity is not improved by stagnant access and can be hindered by incorrect permissions.
• C: Compliance posture degrades without documented audits, leading to legal and financial penalties.
• D: Long-term administrative costs increase due to the high price of incident response and remediation.

Think like a manager:

Identity is a critical control plane. Regular access attestation is a governance requirement that ensures technical permissions remain aligned with the organization's evolving risk appetite.