CIAM Governance and Compliance 3

Question 1

Which IAM audit technique uses automated comparison of current user access rights against an approved entitlement baseline?

Accepted Answer

Variance analysis

Answer

Variance analysis compares actual entitlements to an approved baseline, flagging differences that may indicate unauthorized or drifted access.

Question 2

Under NIST SP 800-53, which control family most directly governs access control policies and procedures?

Accepted Answer

AC – Access Control

Answer

The AC (Access Control) family in NIST SP 800-53 contains controls for account management, access enforcement, and least privilege.

Question 3

A compliance auditor asks for evidence that privileged access is reviewed quarterly. Which IAM artifact best satisfies this request?

Accepted Answer

Completed access certification reports with timestamps

Answer

Completed access certification reports with timestamps demonstrate that privileged accounts were reviewed at the required frequency.

Question 4

In IAM governance, 'toxic combinations' refer to:

Accepted Answer

Combinations of permissions that violate segregation of duties

Answer

Toxic combinations are pairs or sets of entitlements that, when held by the same user, violate segregation of duties and create fraud or error risk.

Question 5

Which regulation requires US federal agencies to use FIPS 201-compliant credentials for logical access to IT systems?

Accepted Answer

FISMA

Answer

FISMA (Federal Information Security Modernization Act) mandates that federal agencies comply with NIST standards, including FIPS 201 for Personal Identity Verification.

(CIAM) Certified Identity and Access Manager Practice Test

(CIAM) Certified Identity and Access Manager Practice Test

CIAM Governance and Compliance 3