CIAM Governance and Compliance 3

Question 1

Which IAM audit technique uses automated comparison of current user access rights against an approved entitlement baseline?

Accepted Answer

Variance analysis

Answer

Penetration testing

Answer

Access recertification campaign

Answer

Control self-assessment

Question 2

Under NIST SP 800-53, which control family most directly governs access control policies and procedures?

Accepted Answer

AC – Access Control

Answer

AU – Audit and Accountability

Answer

IA – Identification and Authentication

Answer

CM – Configuration Management

Question 3

A compliance auditor asks for evidence that privileged access is reviewed quarterly. Which IAM artifact best satisfies this request?

Accepted Answer

Completed access certification reports with timestamps

Answer

Network topology diagram

Answer

Firewall rule change logs

Answer

User onboarding checklists

Question 4

In IAM governance, 'toxic combinations' refer to:

Accepted Answer

Combinations of permissions that violate segregation of duties

Answer

Two-factor authentication methods that conflict

Answer

Accounts with both local and federated credentials

Answer

Roles that expire before they are assigned

Question 5

Which regulation requires US federal agencies to use FIPS 201-compliant credentials for logical access to IT systems?

Accepted Answer

FISMA

Answer

FERPA

Answer

COPPA

Answer

GLBA

Question 6

An access review finds that a developer has both 'deploy to production' and 'approve production changes' permissions. Which governance concept does remediating this violation address?

Accepted Answer

Segregation of duties

Answer

Dual control

Answer

Defense in depth

Answer

Role explosion

Question 7

Under CCPA, what right allows California consumers to request that a business delete personal information collected about them?

Accepted Answer

Right to deletion

Answer

Right to portability

Answer

Right to opt-out

Answer

Right to non-discrimination