Which statement describes deprovisioning in an IAM lifecycle?

• A. It sets up MFA for new users.
• B. It audits privileged sessions.
• C. It disables or deletes accounts and removes access when no longer needed, while preserving or migrating data.
• D. It creates accounts and assigns initial access.

Answer: (C)

Deprovisioning in an IAM lifecycle is about removing access and disabling or deleting user identities when they no longer need access, while ensuring any data they owned is preserved or moved appropriately. The correct statement describes disabling or deleting accounts and removing access when no longer needed, with data either preserved for compliance or migrated to the rightful owner or an archive. This protects systems from unauthorized access when someone leaves or changes roles, and it keeps records or data ownership intact. In contrast, setting up MFA, auditing privileged sessions, or creating accounts with initial access are all part of provisioning—the onboarding side of IAM—not deprovisioning.