Correct answers: A, B, C, and D. Role based permissions; Individual user accounts; Periodic access review; Remove access when a role changes.
Role based access, individual accounts, periodic review, and prompt removal of old permissions reduce exposure.