CIAM CIAM Audit and Monitoring 2 — Questions and Answers
Question 1: What is 'segregation of duties' (SoD) in IAM?
- Physically separating IT staff from business users
- Ensuring no single person holds enough access rights to commit and conceal a fraudulent action alone (Correct answer)
- Dividing the IAM platform into isolated functional modules
- Separating the authentication system from the authorization engine
Correct answer: Ensuring no single person holds enough access rights to commit and conceal a fraudulent action alone
Segregation of Duties ensures that sensitive processes require involvement from multiple individuals by distributing the necessary access rights across different people.
Question 2: What is a 'toxic combination' in access management?
- Incompatible identity management software products
- A set of access rights that together create an unacceptable security or fraud risk when held by one person (Correct answer)
- A dangerous password pattern identified by policy scanning
- Conflicting firewall rules that block legitimate federation traffic
Correct answer: A set of access rights that together create an unacceptable security or fraud risk when held by one person
A toxic combination is a set of permissions that, when granted to the same individual, violates segregation of duties — for example, having both payment creation and payment approval rights.
Question 3: What does 'log integrity' mean in IAM auditing?
- Ensuring audit logs are human-readable and well-formatted
- Protecting audit records from modification or deletion to preserve their evidentiary trustworthiness (Correct answer)
- Compressing log files to reduce storage requirements
- Synchronizing log timestamps across distributed systems
Correct answer: Protecting audit records from modification or deletion to preserve their evidentiary trustworthiness
Log integrity ensures audit records cannot be altered after creation, typically enforced through cryptographic controls, write-once storage, or tamper-evident log chains.
Question 4: What is the purpose of a recertification campaign in IAM?
- Recertifying IAM administrators' professional credentials
- Periodically requiring managers to review and reconfirm that team members' access rights remain appropriate (Correct answer)
- Renewing SSL/TLS certificates used in the IAM infrastructure
- Restarting IAM services to apply configuration changes
Correct answer: Periodically requiring managers to review and reconfirm that team members' access rights remain appropriate
Recertification campaigns mandate that access rights be actively reconfirmed on a scheduled basis, rather than remaining in place indefinitely once granted.
Question 5: What is 'orphan account' detection in IAM?
- Finding user accounts that lack assigned passwords
- Identifying active accounts that remain after the associated employee has left or changed roles (Correct answer)
- Detecting anonymous guest accounts in directory services
- Finding shared service accounts with no designated owner
Correct answer: Identifying active accounts that remain after the associated employee has left or changed roles
Orphan account detection identifies accounts that remain enabled after the associated user has been terminated or transferred, reducing the attack surface from stale credentials.
Question 6: What is the difference between authentication logging and authorization logging?
- There is no meaningful difference between the two types
- Authentication logging records identity verification events; authorization logging records access control decisions (Correct answer)
- Authentication logging is encrypted while authorization logging is stored in plain text
- Authorization logging records password changes while authentication logging records role assignments
Correct answer: Authentication logging records identity verification events; authorization logging records access control decisions
Authentication logging captures login and logout events that verify identity, while authorization logging records access control decisions — what resources were allowed or denied to authenticated users.
CIAM CIAM Audit and Monitoring 2
What is 'segregation of duties' (SoD) in IAM?