CIAM Governance and Compliance 2

Question 1

Under GDPR, what is the maximum fine for a Tier 2 violation as a percentage of global annual turnover?

Accepted Answer

4%

Answer

GDPR Tier 2 violations (the most serious) carry fines up to 4% of global annual turnover or €20 million, whichever is higher.

Question 2

Which IAM governance framework artifact maps business roles to IT entitlements?

Accepted Answer

Role catalog

Answer

A role catalog defines and maps business roles to their associated IT entitlements, forming the foundation of role-based access control governance.

Question 3

A SOC 2 Type II report differs from SOC 2 Type I primarily in that it:

Accepted Answer

Evaluates controls over a period of time rather than a point in time

Answer

SOC 2 Type II evaluates the operational effectiveness of controls over a defined period (typically 6–12 months), while Type I assesses design at a single point in time.

Question 4

Which principle requires that access rights be reviewed and removed when no longer needed for a job function?

Accepted Answer

Least privilege

Answer

Least privilege mandates that users retain only the minimum access necessary for their current role, requiring revocation when access is no longer justified.

Question 5

Under HIPAA, which entity must sign a Business Associate Agreement (BAA) with a covered entity?

Accepted Answer

Vendors who handle protected health information on behalf of the covered entity

Answer

A BAA is required for any business associate that creates, receives, maintains, or transmits PHI on behalf of a HIPAA covered entity.

(CIAM) Certified Identity and Access Manager Practice Test

(CIAM) Certified Identity and Access Manager Practice Test

CIAM Governance and Compliance 2