CIAM Identity Governance 2 — Questions and Answers
Question 1: Which process ensures that users only retain access rights that are still required for their current job function?
- Access certification (Correct answer)
- Segregation of duties
- Privilege escalation
- Role mining
Correct answer: Access certification
Access certification (also called access review or recertification) periodically validates that user entitlements remain appropriate for their current role.
Question 2: In identity governance, what does 'toxic combinations' refer to?
- Expired credentials stored together
- Conflicting permissions that violate SoD policy (Correct answer)
- Duplicate user accounts merged incorrectly
- Roles assigned without approval workflows
Correct answer: Conflicting permissions that violate SoD policy
Toxic combinations are pairs or groups of entitlements that, when held by the same user, create a Segregation of Duties (SoD) violation and increase fraud risk.
Question 3: A governance policy requires that no single employee can create vendors AND approve payments. This is an example of:
- Least privilege
- Separation of duties (Correct answer)
- Need-to-know principle
- Role explosion
Correct answer: Separation of duties
Separation of duties (SoD) prevents a single individual from controlling a complete high-risk process, reducing fraud and error risk.
Question 4: What is the primary purpose of an identity governance 'fulfillment' workflow?
- Detecting anomalous login behavior
- Automatically provisioning approved access requests (Correct answer)
- Encrypting identity data at rest
- Generating audit logs for compliance
Correct answer: Automatically provisioning approved access requests
Fulfillment workflows execute the provisioning actions (granting or revoking access) after an access request has been approved.
Question 5: Which metric best measures the effectiveness of an access review campaign?
- Number of roles defined in the IGA system
- Percentage of certifications completed on time (Correct answer)
- Total number of users provisioned
- Average password length across accounts
Correct answer: Percentage of certifications completed on time
Certification completion rate measures how thoroughly reviewers fulfilled their obligation to validate user access, directly indicating review effectiveness.
Question 6: What is 'role creep' in the context of identity governance?
- A role with too few members to justify maintenance
- The gradual accumulation of access rights beyond what a user needs (Correct answer)
- Automatic role assignment triggered by HR system changes
- A role that spans multiple business units
Correct answer: The gradual accumulation of access rights beyond what a user needs
Role creep occurs when users accumulate privileges over time through job changes or project assignments without removal of previously granted rights.
Question 7: In an IGA system, what does a 'policy violation' typically trigger?
- Immediate account lockout
- A remediation workflow or alert for review (Correct answer)
- Deletion of the conflicting role
- Automatic escalation to multifactor authentication
Correct answer: A remediation workflow or alert for review
IGA systems surface policy violations (such as SoD conflicts) and trigger remediation workflows that route the issue to an approver or compliance team.
CIAM Identity Governance 2
Which process ensures that users only retain access rights that are still required for their current job function?