CIAM Identity Lifecycle 3 — Questions and Answers
Question 1: Which standard protocol is commonly used for automated provisioning and deprovisioning of identities across cloud services?
- SAML 2.0
- OAuth 2.0
- SCIM 2.0 (Correct answer)
- LDAP v3
Correct answer: SCIM 2.0
SCIM (System for Cross-domain Identity Management) is the industry-standard protocol designed specifically for automating user provisioning across cloud applications.
Question 2: What is 'access creep' and why is it a concern in identity lifecycle management?
- Gradual reduction of access rights due to automation errors
- Accumulation of unnecessary privileges over time as roles change (Correct answer)
- Unauthorized access obtained through phishing attacks
- Over-provisioning of birthright access during onboarding
Correct answer: Accumulation of unnecessary privileges over time as roles change
Access creep occurs when users accumulate permissions from previous roles that are never revoked, violating least privilege and increasing breach risk.
Question 3: An access certification campaign is best described as:
- A process for certifying new joiners before account creation
- A periodic review where managers confirm or revoke user entitlements (Correct answer)
- An automated scan that identifies misconfigured access policies
- A compliance audit of the IAM system's technical controls
Correct answer: A periodic review where managers confirm or revoke user entitlements
Access certification (or access review) is a recurring process where account owners or managers attest that users' current access is still appropriate.
Question 4: Which lifecycle event most commonly triggers a re-certification review of all existing user access?
- A user's password expiration
- A significant organizational restructuring or merger (Correct answer)
- A new regulatory framework announcement
- A user logging in from an unusual geographic location
Correct answer: A significant organizational restructuring or merger
Organizational restructuring or mergers can invalidate existing role structures, making a full access review necessary to ensure entitlements remain appropriate.
Question 5: In a federated identity model, who manages the authoritative lifecycle data for an external partner's employees?
- The relying party's IAM team
- The partner organization's own identity provider (Correct answer)
- A shared neutral identity broker
- The CIAM platform's central directory
Correct answer: The partner organization's own identity provider
In federation, the partner's own identity provider is authoritative for their employees' lifecycle data, reducing administrative burden on the relying party.
Question 6: What is the key difference between account disablement and account deletion in offboarding workflows?
- Disablement is permanent while deletion allows recovery
- Disablement preserves the account and data for audit; deletion removes them (Correct answer)
- Deletion is faster and preferred for all offboarding scenarios
- Disablement applies to contractors only; deletion applies to employees
Correct answer: Disablement preserves the account and data for audit; deletion removes them
Disabling an account blocks access while retaining the account and associated data for audit trails, litigation holds, and knowledge transfer; deletion is irreversible.
Question 7: What does 'just-in-time (JIT) provisioning' mean in identity lifecycle management?
- Accounts are pre-provisioned 24 hours before a user's first login
- An account is created automatically at the moment of a user's first authentication (Correct answer)
- Access rights are granted only during approved business hours
- Provisioning is triggered only when an SLA breach is detected
Correct answer: An account is created automatically at the moment of a user's first authentication
JIT provisioning creates user accounts on-demand during the first authentication event, reducing administrative overhead and the risk of stale pre-provisioned accounts.
CIAM Identity Lifecycle 3
Which standard protocol is commonly used for automated provisioning and deprovisioning of identities across cloud services?