Before applications become active or are released to customers, what must be done with development, test, and custom application accounts?

Before applications become active or are released to customers, what must be done with development, test, and custom application accounts?

• A. They must be removed
• B. They must be kept but disabled
• C. They must be renamed
• D. They must be migrated to production accounts

Answer: (A)

Removing those accounts before production is released is about reducing the attack surface and preventing privileged access that isn’t needed in the live environment. Development, test, and custom application accounts are often created quickly for debugging or feature work and can carry broad permissions or weak credentials. If any of them linger in production, they could be exploited to access systems, view sensitive data, or bypass controls, especially if they aren’t as tightly monitored or rotated as production accounts. Purging them ensures that only properly provisioned, production-grade accounts with validated access are present, and it supports secure change-management and least-privilege practices. Keeping them disabled would still leave the potential for reactivation, misconfiguration, or unnoticed gaps. Renaming doesn’t reduce risk and can be ignored or forgotten in audits. Migrating them to production would grant inappropriate access and blur the line between development and live environments.

Removing those accounts before production is released is about reducing the attack surface and preventing privileged access that isn’t needed in the live environment. Development, test, and custom application accounts are often created quickly for debugging or feature work and can carry broad permissions or weak credentials. If any of them linger in production, they could be exploited to access systems, view sensitive data, or bypass controls, especially if they aren’t as tightly monitored or rotated as production accounts. Purging them ensures that only properly provisioned, production-grade accounts with validated access are present, and it supports secure change-management and least-privilege practices.

Keeping them disabled would still leave the potential for reactivation, misconfiguration, or unnoticed gaps. Renaming doesn’t reduce risk and can be ignored or forgotten in audits. Migrating them to production would grant inappropriate access and blur the line between development and live environments.