CCISO Identity & Access Management 3

Question 1

Privileged Access Management (PAM) solutions are primarily deployed to:

Accepted Answer

Manage and monitor the use of accounts with elevated administrative rights across enterprise systems

Answer

Encrypt communications between end-user workstations

Answer

Provide antivirus protection for servers

Answer

Automate patch management for operating systems

Question 2

Access creep, a common IAM risk, occurs when:

Accepted Answer

Users accumulate more access rights over time than their current role requires, often due to role changes without access revocation

Answer

Users attempt to access systems outside of normal business hours

Answer

External attackers gradually escalate privileges within a system

Answer

Passwords are incrementally weakened through repeated reuse

Question 3

Just-In-Time (JIT) access provisioning is an IAM strategy that:

Accepted Answer

Grants elevated or sensitive access only when needed for a specific task and revokes it immediately afterward

Answer

Pre-provisions all required access rights before an employee starts

Answer

Synchronizes access rights across all systems in real time

Answer

Provides permanent standing privileges to all senior managers

Question 4

What is the key difference between authentication and authorization in the context of IAM?

Accepted Answer

Authentication verifies the identity of a user, while authorization determines what that verified identity is permitted to do

Answer

Authentication is performed by humans while authorization is automated

Answer

Authentication applies to external users while authorization applies to internal users

Answer

Authentication is optional while authorization is always mandatory

Question 5

Under the CCISO exam framework, which domain most directly encompasses Identity and Access Management as a core competency area?

Accepted Answer

Domain 3: Security Program Management & Operations

Answer

Domain 1: Governance & Risk Management

Answer

Domain 2: Information Security Controls, Compliance & Audit Management

Answer

Domain 5: Strategic Planning, Finance, Procurement & Third-Party Management

Question 6

Which IAM process ensures that a new employee receives only the access rights necessary for their specific role on their first day of employment?

Accepted Answer

Joiner-Mover-Leaver (JML) provisioning — specifically the joiner workflow

Answer

Access recertification

Answer

Emergency access break-glass procedure

Answer

Privilege escalation review

Question 7

A CISO reviewing IAM metrics notices that 15% of user accounts have not been accessed in over 90 days. What is the most appropriate immediate action?

Accepted Answer

Disable or lock inactive accounts pending business justification review and formal reactivation process

Answer

Immediately delete all inactive accounts without further review

Answer

Reset passwords on all inactive accounts and notify users

Answer

Increase password complexity requirements for all users