CIAM Governance and Compliance 4

Question 1

Which governance metric measures the percentage of user accounts that have completed a scheduled access review within the required timeframe?

Accepted Answer

Certification completion rate

Answer

Certification completion rate tracks what portion of accounts were reviewed and attested (or revoked) within the mandated review window.

Question 2

An IAM policy exception process should require which of the following before granting a temporary deviation from policy?

Accepted Answer

Documented business justification, risk acceptance, and a defined expiration date

Answer

A sound exception process requires documented justification, formal risk acceptance by an appropriate owner, and an expiration so exceptions do not become permanent.

Question 3

Which ISO standard specifically addresses information security management systems and is commonly used as an IAM governance framework reference?

Accepted Answer

ISO 27001

Answer

ISO 27001 specifies requirements for establishing, implementing, and maintaining an information security management system, including access control objectives.

Question 4

A 'ghost account' in IAM governance terminology refers to:

Accepted Answer

An active account belonging to a user who no longer exists in the HR system

Answer

Ghost (or orphan) accounts are active user accounts that remain in the system after the associated employee has left, posing a significant security and compliance risk.

Question 5

Which regulatory framework requires financial institutions to implement a written information security program covering administrative, technical, and physical safeguards?

Accepted Answer

GLBA Safeguards Rule

Answer

The GLBA Safeguards Rule requires financial institutions to develop, implement, and maintain a comprehensive written information security program.

(CIAM) Certified Identity and Access Manager Practice Test

(CIAM) Certified Identity and Access Manager Practice Test

CIAM Governance and Compliance 4