CIAM Governance and Compliance 5

Question 1

A company subject to SOX must ensure that financial system access controls are tested by:

Accepted Answer

An independent auditor as part of ICFR testing

Answer

The system owner annually

Answer

The CISO on a quarterly basis

Answer

The IAM team using automated scans only

Question 2

Which IAM governance activity involves analyzing existing access assignments to discover and define roles based on actual usage patterns?

Accepted Answer

Role mining

Answer

Access recertification

Answer

Entitlement catalog creation

Answer

Policy exception review

Question 3

An organization wants to demonstrate continuous compliance with access control requirements. Which approach best achieves this compared to point-in-time audits?

Accepted Answer

Implementing automated, real-time control monitoring with alerting

Answer

Increasing the frequency of manual access reviews to monthly

Answer

Hiring additional auditors to conduct more assessments

Answer

Requiring employees to self-certify their access annually

Question 4

Under the EU AI Act's risk-based framework, which category of AI system would an automated identity verification system used for high-stakes decisions most likely fall into?

Accepted Answer

High risk

Answer

Minimal risk

Answer

Limited risk

Answer

Unacceptable risk

Question 5

Which principle in the FAIR (Factor Analysis of Information Risk) model represents the probable frequency of a threat event occurring?

Accepted Answer

Threat event frequency

Answer

Loss magnitude

Answer

Vulnerability

Answer

Risk

Question 6

A governance board wants to reduce identity-related risk without increasing operational burden. Which IAM initiative best balances both goals?

Accepted Answer

Implementing risk-based access certification that focuses reviews on high-risk accounts

Answer

Requiring all users to request access through a help desk ticket

Answer

Expanding manual quarterly reviews to all user populations

Answer

Removing all standing privileged access and requiring re-approval daily

Question 7

Which document formally defines the acceptable use, ownership, and enforcement responsibilities for IAM policies within an organization?

Accepted Answer

Identity governance charter

Answer

System security plan

Answer

Business continuity plan

Answer

Incident response playbook