When should development, test, and/or custom application accounts be removed?

• A. Immediately after development
• B. Before activation
• C. After release to customers
• D. Never remove

Answer: (B)

The main idea is to minimize the attack surface by removing accounts that were created for development and testing before the system goes into production. Development, test, and custom application accounts often have elevated access or credentials tied to non-production processes. If these accounts remain active after deployment, they can be discovered and abused, compromising system security and PCI DSS expectations around secure configuration and access control. Disabling or removing them before activation ensures only production-ready identities exist in the live environment, reducing risk. Leaving them in place after release or never removing them would unnecessarily widen the potential entry points for attackers.