CIAM Governance and Compliance 5

Question 1

A company subject to SOX must ensure that financial system access controls are tested by:

Accepted Answer

An independent auditor as part of ICFR testing

Answer

SOX Section 404 requires management assessment and independent auditor testing of internal controls over financial reporting (ICFR), including access controls.

Question 2

Which IAM governance activity involves analyzing existing access assignments to discover and define roles based on actual usage patterns?

Accepted Answer

Role mining

Answer

Role mining analyzes current user entitlements to identify natural groupings and patterns that can be formalized into roles for RBAC implementation.

Question 3

An organization wants to demonstrate continuous compliance with access control requirements. Which approach best achieves this compared to point-in-time audits?

Accepted Answer

Implementing automated, real-time control monitoring with alerting

Answer

Automated real-time monitoring continuously validates that controls are in place and immediately flags violations, providing a stronger assurance posture than periodic reviews.

Question 4

Under the EU AI Act's risk-based framework, which category of AI system would an automated identity verification system used for high-stakes decisions most likely fall into?

Accepted Answer

High risk

Answer

AI systems used for biometric identification or access decisions in high-stakes contexts are classified as high-risk under the EU AI Act and subject to strict requirements.

Question 5

Which principle in the FAIR (Factor Analysis of Information Risk) model represents the probable frequency of a threat event occurring?

Accepted Answer

Threat event frequency

Answer

Threat Event Frequency (TEF) in the FAIR model quantifies how often a threat agent is likely to act against an asset over a given time period.

(CIAM) Certified Identity and Access Manager Practice Test

(CIAM) Certified Identity and Access Manager Practice Test

CIAM Governance and Compliance 5