After identifying inactive users using the CrowdStrike CIEM/Identity Analyzer, what is the most appropriate action to mitigate risks associated with…

Option A: Transferring permissions without a clear business need or appropriate analysis can lead to

excessive privilege assignments and violate the principle of least privilege, increasing the risk of insider

threats or accidental misuse.

Option B: Temporarily disabling inactive accounts allows organizations to verify whether the accounts

are genuinely no longer in use while preventing immediate security risks. Monitoring for unexpected

activity during the temporary disablement phase helps identify potential misuse or ongoing necessity of

the account, ensuring informed decisions about deactivation or deletion.

Option C: Deactivating accounts without addressing roles and permissions still poses a security risk.

Inactive accounts with retained permissions can be re-enabled or misused inappropriately.

Option D: While deleting inactive accounts removes potential attack vectors, this approach is risky

without prior analysis. Some accounts may be needed for legacy systems or auditing purposes, leading to

operational disruption.

78/192