An organization practices the principle of least privilege.
To ensure access remains appropriate, application owners should be required to review user access rights on a regular basis by obtaining:
A . security logs to determine the cause of invalid login attempts.
B . documentation indicating the intended users of the application.
C . an access control matrix and approval from the user’s manager.
D . business purpose documentation and software license counts.
Answer: B