PCI Approved Scanning Vendor (ASV) Online Practice Test

The idea being tested is accountability and traceability in system administration. To keep actions attributable to a specific person, you avoid generic or shared accounts and require individual, unique admin credentials. Disabling or removing generic IDs, ensuring there are no shared IDs, and not using such IDs to administer components means every privileged action can be tied to a particular administrator, which supports proper auditing, monitoring, and the ability to revoke access promptly.

Using generic IDs for convenience undermines accountability because it hides who actually performed an action. Allowing shared IDs without an audit trail defeats traceability, making it impossible to determine responsibility for changes or incidents. Relying on default credentials is insecure and violates best practices for access control, increasing the risk of unauthorized access.