CIAM Foundational Frameworks 2

Question 1

Which NIST publication provides the primary guidance for digital identity risk management and defines assurance levels?

Accepted Answer

NIST SP 800-63

Answer

NIST SP 800-63 defines Identity Assurance Level (IAL), Authenticator Assurance Level (AAL), and Federation Assurance Level (FAL).

Question 2

Under the Zero Trust Architecture framework, which principle states that no user or device should be inherently trusted regardless of network location?

Accepted Answer

Never trust, always verify

Answer

The 'never trust, always verify' principle is the foundational tenet of Zero Trust, requiring continuous authentication and authorization.

Question 3

In the OAuth 2.0 framework, what is the role of the Authorization Server?

Accepted Answer

Issues access tokens after authenticating the resource owner

Answer

The Authorization Server authenticates the resource owner and issues access tokens to the client after obtaining authorization.

Question 4

Which identity governance concept ensures that a user's access rights are reviewed and confirmed by an authoritative party at regular intervals?

Accepted Answer

Access certification

Answer

Access certification (access review/recertification) is the periodic process of validating that users still require their current access rights.

Question 5

The SCIM (System for Cross-domain Identity Management) protocol is primarily used for which purpose?

Accepted Answer

Automating user provisioning and deprovisioning across systems

Answer

SCIM provides a standardized REST-based API for automating the exchange of user identity information between identity domains.

(CIAM) Certified Identity and Access Manager Practice Test

(CIAM) Certified Identity and Access Manager Practice Test

CIAM Foundational Frameworks 2