Certified Incident Handler (ECIH v3) — Question 17

When an employee is terminated from his or her job, what should be the next immediate step taken by an organization?

Answer options

• A. All access rights of the employee to physical locations, networks, systems, applications and data should be disabled
• B. The organization should enforce separation of duties
• C. The access requests granted to an employee should be documented and vetted by the supervisor
• D. The organization should monitor the activities of the system administrators and privileged users who have permissions to access the sensitive information

Correct answer: A

Explanation

The correct answer is A because it is crucial to immediately disable all access rights to prevent any potential misuse of sensitive information after termination. Options B, C, and D, while important for overall security management, do not address the immediate need to revoke access that could lead to security breaches.