Provisioning, Deprovisioning, and Access Reviews

CompTIA Security+ SY0-701

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

Current Exam Facts and How Security+ Tests Judgment Domain Weighting and an 8-12 Week Study Plan Practice Questions, PBQs, and the Missed-Question Notebook

2 Domain 1: General Security Concepts (12%)

CIA and Non-Repudiation Control Types and Categories with Scenario Classification Security Principles: Least Privilege, Defense in Depth, Secure by Design, and Zero Trust Change Management and Business Impact

3 Domain 1: Identity, Trust, and Cryptography Basics

AAA and IAM Concepts Authentication Factors and MFA Traps Authorization Models: RBAC, ABAC, MAC, DAC, and Least Privilege Cryptography, Hashes, Signatures, PKI, and Certificate Decision Rules

4 Domain 2: Threat Actors, Vectors, and Social Engineering

Threat Actors and Motivations Attack Vectors and Attack Surface Social Engineering Types and Clues Supply Chain and Insider Threat Scenarios

5 Domain 2: Threats, Vulnerabilities, and Mitigations - Attacks

Malware Behaviors and Indicators Credential and Password Attacks Network and Wireless Attacks Application, API, and Cloud Attacks with Mitigation Mapping

6 Domain 2: Threats, Vulnerabilities, and Mitigations - Vulnerabilities

Vulnerability Types and Misconfiguration Vulnerability Scanning and Prioritization Secure Coding and Application Mitigations Remediation, Compensating Controls, and Risk-Based Decisions

7 Domain 3: Security Architecture - Secure Architecture Models

Architecture Models and Trust Boundaries Cloud Shared Responsibility and Service Models Zero Trust, SASE, and SSE Concepts Secure Design Review Scenarios

8 Domain 3: Security Architecture - Network Security Architecture

Segmentation, VLANs, DMZ, and Microsegmentation Firewalls, WAF, IDS, IPS, and Proxies VPN, Remote Access, and NAC Wireless Security and Enterprise Network Design

9 Domain 3 Part C: Data Protection and Resilience

Data Classification and Handling Encryption at Rest, in Transit, in Use, and Key Management DLP, Privacy, and the Data Lifecycle Backups, RTO, RPO, BCP, DR, and Resilience

10 Domain 4 Part A: Secure Operations for Hosts, Cloud, Mobile, and IoT

Endpoint and Server Hardening Cloud, Container, and Virtualization Operations Mobile, BYOD, and MDM Embedded, IoT, OT, and Physical Device Security

11 IAM Operations and Access Control

Provisioning, Deprovisioning, and Access Reviews PAM, JIT, JEA, and Service Accounts Federation, SSO, SAML, OIDC, and OAuth Account Attacks and IAM Monitoring

12 Logging, Monitoring, and Detection

Log Sources and Telemetry SIEM Correlation and Alert Triage SOAR, Playbooks, and Automation Detection Use Cases and False-Positive Handling

13 Incident Response

IR Phases and Roles Containment, Eradication, and Recovery Decisions Communication, Escalation, Legal, and Regulatory Considerations Post-Incident Lessons Learned and Metrics

14 Digital Forensics and Investigation

Evidence Handling and Chain of Custody Disk, Memory, Network, and Log Artifacts Order of Volatility and Acquisition Choices Forensic Reporting and Anti-Forensics Traps

15 Vulnerability, Patch, Asset, and Automation Operations

Asset Inventory and Data Classification in Ops Vulnerability Lifecycle and CVSS/Risk Priority Patch, Change, and Configuration Management Automation, Orchestration, SCAP, and Security Tooling

16 Governance, Policies, and Risk Management

Governance Documents: Policy, Standard, Procedure, and Baseline Risk Register and Risk Treatment Quantitative/Qualitative Risk and BIA Exceptions, Acceptance, Ownership, and Reporting

17 Third-Party Risk, Compliance, and Privacy

Vendor Risk Lifecycle and Agreements Due Diligence, Questionnaires, and Monitoring Privacy Concepts and Data Rights Compliance Reporting and Consequences

18 Audits, Penetration Testing, and Awareness

Internal and External Audits and Evidence Penetration Test Types and Rules of Engagement Security Awareness, Training, and Phishing Metrics Personnel and Physical Security Program Controls

19 Final Review and PBQ Labs

PBQ Workflow and Timing Ports, Protocols, and Acronyms High-Yield Tables Firewall, IAM, Log, and Risk PBQ Mini-Labs Final 7-Day Review Plan Mixed Exam Strategy and Missed-Question Remediation

Provisioning, Deprovisioning, and Access Reviews

Key Takeaways Explain This Topic AI

Provisioning creates or changes identities and access based on an approved business need driven from an authoritative source such as HR.

Deprovisioning must remove every access path quickly when a person leaves or changes roles, not just the primary application login.

Access reviews (recertification) compare current permissions against job duties, risk, and separation-of-duties requirements.

Joiner, mover, and leaver workflows reduce orphaned accounts, privilege creep, and missed approvals.

Strong IAM evidence includes ticket approvals, role mappings, review decisions, and timestamps that an auditor can trace end to end.

Last updated: June 2026

IAM as an Operational Process

Identity and access management (IAM) is an operational lifecycle, not just a login screen. On the CompTIA Security+ SY0-701 exam (up to 90 questions, 90 minutes, passing score 750 on a 100-900 scale), Domain 4 (Security Operations) and Domain 5 (Security Program Management) repeatedly ask whether a control prevents unauthorized access, proves accountability, or supports least privilege (granting only the access a role needs). The right answer almost always traces back to where you are in the identity lifecycle: joiner , mover , or leaver (sometimes called JML).

Provisioning should originate from an authoritative source (system of record) such as an HR information system, student information system, or contractor management platform. That source establishes who the person is and what business relationship exists. It does not make access safe by itself. The security decision still requires role mapping, an approval, and an audit log entry. SY0-701 expects you to know that automated provisioning without governance simply makes mistakes faster.

Joiner, Mover, Leaver Workflow

Event Trigger Security goal Example action

Joiner New hire or contractor starts Grant only the approved baseline (least privilege) Create account from HR record, assign role-based group, enforce MFA enrollment

Mover Department or duty change Remove old access before adding new access Replace finance groups with procurement groups

Leaver Exit or contract end Disable all access fast, preserve evidence Disable SSO, revoke tokens, rotate exposed shared secrets, reassign mailbox

The mover stage is where most environments fail. If old access is never removed, the user accumulates permissions that no longer match the job. That is privilege creep (also called permission accumulation or access aggregation), and it is one of the highest-frequency vocabulary terms in IAM questions.

Scenario Walkthrough

A regional hospital hires a billing analyst. HR marks the worker active on Monday. The IAM platform creates a directory account, assigns the billing-analyst role group, and requires multi-factor authentication (MFA) enrollment before the first application launch. The user reaches claims software and the document portal, but not clinical administration tools.

Two months later the analyst transfers to patient scheduling. The mover workflow should remove the billing group and add the scheduling group. If billing access lingers, the analyst can now both submit and approve claims and edit schedules, which may break a separation of duties (SoD) rule and enable fraud.

Six months later the worker resigns. The leaver workflow disables the directory account, revokes cloud and SSO sessions, removes VPN access, rotates any shared credential the user knew, and transfers mailbox ownership to a supervisor. A ticket records termination time, workflow completion time, systems affected, and exceptions. An account left enabled after departure is an orphaned account , a classic exam wrong-state.

Access Review (Recertification) Table

• User Current access Owner decision Security note
• arivera Billing analyst + scheduling lead Remove billing Mover access never cleaned up (privilege creep)
• mpatel Read-only claims archive Keep Needed for audit support through quarter end
• svc-claims-export Claims export writer Keep w/ attestation Service account; verify owner + secret rotation
• jnguyen Domain admin Remove No approved privileged role in HR record

Reviews are usually run quarterly for privileged access and at least annually for standard access , plus an event-driven review after any role change. A reviewer cannot decide from a raw group name like APP-QA-RW-7; the review must state what the permission allows, who owns the application, when it was last used, and whether it creates an SoD conflict.

Common Traps

Disabling only the application account while leaving SSO, VPN, API keys, and refresh tokens active.

Adding new role access during a transfer without removing the old role access.

Treating a manager rubber-stamp approval as a substitute for least privilege.

Reviewing only human accounts while ignoring service accounts and shared mailboxes.

• Keeping emergency "break-glass" access permanently assigned "just in case."
• Time-Bound and Risk-Based Provisioning

Not every grant should be permanent. Time-based access automatically expires entitlements on a set date, which is ideal for contractors, interns, and project teams; the system deprovisions without anyone remembering to file a leaver ticket. Compare this with continuous (standing) access , which persists until manually removed and is the seedbed for orphaned accounts. SY0-701 rewards the answer that makes access expire by default.

Provisioning models also differ by trust requirement. A medical clinic might require a manager approval plus a security review before granting access to a system holding electronic protected health information, while a low-risk wiki is auto-granted from the role group. Matching approval rigor to data sensitivity is a direct application of risk-based access control.

Mapping Reviews to Compliance

Access recertification is frequently mandated by frameworks the exam references. Sarbanes-Oxley (SOX) drives financial-system reviews, PCI DSS requires reviewing user access at least every six months, and frameworks such as ISO 27001 and the NIST Cybersecurity Framework expect documented periodic review. When a question pairs an audit finding with a remediation, the recertification-with-evidence answer satisfies both the control and the auditor.

Exam Focus

Expect wording such as least privilege, orphaned account, access recertification, attestation, privilege creep, separation of duties, or termination. The strongest answer closes the lifecycle gap with a repeatable, automated process backed by auditable evidence rather than a one-time manual fix. Watch for distractors that solve only the joiner step (account creation) while ignoring the leaver and mover steps, where most real-world risk accumulates.