In validating privilege enforcement, which activity is recommended?

• A. Ensure all user IDs have identical privileges
• B. Review a sample of privileged and general user IDs to verify privileges align with documented approvals
• C. Confirm that privilege assignments are never updated
• D. Verify that access logs show successful logins for all IDs

Answer: (B)

Verifying privilege enforcement means checking that each user’s actual permissions match the documented approvals and are limited to what is necessary for their role. The best choice reflects this by sampling both privileged and general user IDs and confirming that their privileges align with the documented approvals. This approach directly tests for privilege drift, over-privilege, and improper provisioning, which are core risks in PCI DSS environments.

Why the other options aren’t appropriate: making all user IDs identical in privileges breaks the principle of least privilege and role-based access control. claiming privileges should never be updated prevents needed changes as roles evolve, creating stale and excessive access. focusing on successful logins checks authentication, not whether the authenticated privileges actually match what is approved.