CCISO Identity & Access Management 1 — Questions and Answers
Question 1: What is the primary objective of an Identity and Access Management (IAM) program within an enterprise?
- Encrypting all data at rest and in transit
- Ensuring the right individuals access the right resources at the right times for the right reasons (Correct answer)
- Monitoring network traffic for intrusions
- Managing software licensing and asset inventory
Correct answer: Ensuring the right individuals access the right resources at the right times for the right reasons
IAM programs are designed to ensure appropriate access by verified identities to authorized resources, balancing security with operational efficiency.
Question 2: Which access control model assigns permissions based on an individual's job function or title within an organization?
- Mandatory Access Control (MAC)
- Discretionary Access Control (DAC)
- Role-Based Access Control (RBAC) (Correct answer)
- Attribute-Based Access Control (ABAC)
Correct answer: Role-Based Access Control (RBAC)
RBAC grants access rights based on defined roles, making it easier to manage permissions at scale by mapping users to roles rather than assigning individual rights.
Question 3: The principle of least privilege in IAM requires that users be granted:
- Administrator rights to perform their duties efficiently
- Access only to the resources and data necessary to perform their assigned job functions (Correct answer)
- Read access to all company data for transparency
- Full access during business hours and no access after hours
Correct answer: Access only to the resources and data necessary to perform their assigned job functions
Least privilege minimizes the attack surface by limiting user permissions to only what is required for their specific role, reducing risk from insider threats and compromised accounts.
Question 4: Which authentication factor category includes biometric methods such as fingerprints and retinal scans?
- Something you know
- Something you have
- Something you are (Correct answer)
- Somewhere you are
Correct answer: Something you are
Biometric factors fall under 'something you are' because they are inherent physical or behavioral characteristics unique to the individual.
Question 5: What is the primary security benefit of implementing Single Sign-On (SSO) in an enterprise environment?
- It eliminates the need for any passwords across the enterprise
- It reduces password fatigue and the risk of weak or reused passwords across multiple applications (Correct answer)
- It automatically encrypts all user sessions
- It prevents brute-force attacks on individual applications
Correct answer: It reduces password fatigue and the risk of weak or reused passwords across multiple applications
SSO allows users to authenticate once and access multiple applications, reducing the number of passwords users must manage and lowering the risk of weak or reused credentials.
Question 6: What is the purpose of conducting periodic user access reviews or access recertification campaigns?
- To train employees on new systems
- To ensure that user access rights remain appropriate and remove access that is no longer needed (Correct answer)
- To audit firewall configurations
- To test the performance of IAM systems under load
Correct answer: To ensure that user access rights remain appropriate and remove access that is no longer needed
Access recertification ensures that access rights are valid and current, preventing accumulation of excessive privileges (access creep) over time.
Question 7: A Privileged Access Workstation (PAW) is primarily used to:
- Provide guest network access to visitors
- Perform high-risk administrative tasks in an isolated, hardened environment (Correct answer)
- Host public-facing web applications
- Monitor employee productivity
Correct answer: Perform high-risk administrative tasks in an isolated, hardened environment
A PAW is a dedicated, hardened workstation used exclusively for sensitive administrative tasks to reduce the risk of compromise from malware or phishing attacks on standard workstations.
CCISO Identity & Access Management 1
What is the primary objective of an Identity and Access Management (IAM) program within an enterprise?