How do you handle guest access and external collaborators?

• A. Grant full access to guests by default.
• B. Use guest accounts with restricted access; enforce expiration, monitor activities, require two-factor or sponsor approvals.
• C. Do not track guest activities.
• D. Create separate accounts that never expire.

Answer: (B)

The main concept here is securing guest access by giving temporary, restricted access with oversight and accountability. The best approach is to issue guest accounts that are limited to what they truly need, set automatic expiration so access ends when no longer required, monitor what guests do so you can detect unusual or inappropriate activity, and require an additional security or oversight step—such as two-factor authentication or sponsor approvals—before access is granted. This combination enforces the least-privilege principle, maintains visibility into external collaboration, and minimizes risk if a guest’s involvement ends or changes.

Granting full access by default is risky because it exposes systems to more than necessary. Not tracking guest activities leaves you blind to behavior that could indicate misuse. Creating accounts that never expire fosters lingering access that’s hard to revoke.