CIAM Foundational Frameworks 3 — Questions and Answers
Question 1: Which IAM concept describes a situation where an employee accumulates access rights over time beyond what their current role requires?
- Toxic combination
- Privilege creep (Correct answer)
- Orphan account
- Dormant entitlement
Correct answer: Privilege creep
Privilege creep (or access creep) occurs when users retain permissions from previous roles that are no longer necessary for their current job function.
Question 2: According to the SABSA (Sherwood Applied Business Security Architecture) framework, which layer directly addresses operational security management?
- Contextual layer
- Conceptual layer
- Component layer
- Operational layer (Correct answer)
Correct answer: Operational layer
SABSA's Operational layer addresses the people, processes, and procedures that run and manage the security solution in day-to-day operations.
Question 3: In XACML (eXtensible Access Control Markup Language), which component evaluates a policy request and returns an authorization decision?
- Policy Administration Point (PAP)
- Policy Decision Point (PDP) (Correct answer)
- Policy Enforcement Point (PEP)
- Policy Information Point (PIP)
Correct answer: Policy Decision Point (PDP)
The PDP evaluates access requests against applicable policies and returns permit, deny, or indeterminate decisions.
Question 4: Which concept in IAM governance defines the separation of identity lifecycle management responsibilities so no single administrator can create, enable, and assign privileges to an account alone?
- Dual control
- Segregation of duties (Correct answer)
- Need to know
- Mandatory access control
Correct answer: Segregation of duties
Segregation of duties (SoD) splits critical IAM tasks among multiple individuals to prevent fraud and reduce insider threat risk.
Question 5: A company implements a system where access decisions are based on employee department, job title, and work location attributes. This is an example of which access control model?
- Role-Based Access Control (RBAC)
- Discretionary Access Control (DAC)
- Attribute-Based Access Control (ABAC) (Correct answer)
- Mandatory Access Control (MAC)
Correct answer: Attribute-Based Access Control (ABAC)
ABAC evaluates multiple attributes of the subject, resource, and environment to make fine-grained access control decisions.
Question 6: Which ISO standard specifically addresses information security management systems (ISMS) and is directly relevant to IAM program governance?
- ISO/IEC 27001 (Correct answer)
- ISO/IEC 29101
- ISO 31000
- ISO/IEC 27018
Correct answer: ISO/IEC 27001
ISO/IEC 27001 specifies requirements for establishing, implementing, maintaining, and continually improving an ISMS, which includes IAM controls.
Question 7: In Privileged Access Management (PAM), what is a 'just-in-time' (JIT) access approach designed to prevent?
- Unauthorized federation of privileged accounts
- Standing persistent privileged access that increases attack surface (Correct answer)
- Certificate expiry for service accounts
- Password reuse across privileged accounts
Correct answer: Standing persistent privileged access that increases attack surface
JIT access grants elevated privileges only when needed and for a limited time, eliminating standing privileged accounts that attackers can exploit.
CIAM Foundational Frameworks 3
Which IAM concept describes a situation where an employee accumulates access rights over time beyond what their current role requires?