CIAM Security and Risk Management 2 — Questions and Answers
Question 1: Which risk treatment option involves purchasing cyber liability insurance to cover potential losses from an identity breach?
- Risk avoidance
- Risk transference (Correct answer)
- Risk mitigation
- Risk acceptance
Correct answer: Risk transference
Risk transference shifts the financial impact of a risk to a third party, such as an insurance provider.
Question 2: A CIAM system detects 500 failed login attempts from a single IP in one minute. Which control is BEST suited to address this threat?
- Account lockout after 10 attempts
- Rate limiting and IP-based throttling (Correct answer)
- Requiring password resets for all users
- Disabling the affected user accounts
Correct answer: Rate limiting and IP-based throttling
Rate limiting and IP-based throttling directly counters brute-force and credential-stuffing attacks at the network layer.
Question 3: What is the PRIMARY purpose of a Risk Register in an IAM security program?
- To track user access permissions
- To document, prioritize, and monitor identified risks (Correct answer)
- To store audit logs for compliance purposes
- To define authentication policies for each application
Correct answer: To document, prioritize, and monitor identified risks
A Risk Register is a central repository for recording, assessing, prioritizing, and tracking risks and their treatment plans.
Question 4: An organization's CIAM platform stores PII for millions of customers. Which regulation primarily governs data breach notification requirements in the United States at the federal level for financial institutions?
- GDPR
- CCPA
- GLBA Safeguards Rule (Correct answer)
- HIPAA Privacy Rule
Correct answer: GLBA Safeguards Rule
The GLBA Safeguards Rule (amended 2023) requires financial institutions to notify the FTC within 30 days of a breach affecting 500+ customers.
Question 5: What does 'inherent risk' mean in the context of IAM security assessments?
- The residual risk after all controls are applied
- The risk level before any mitigating controls are in place (Correct answer)
- The risk transferred to a third-party vendor
- The risk accepted by executive leadership
Correct answer: The risk level before any mitigating controls are in place
Inherent risk is the raw or untreated risk exposure that exists before any security controls are implemented.
Question 6: Which attack targets CIAM systems by using large sets of previously stolen username/password pairs to gain unauthorized access?
- Phishing
- SQL injection
- Credential stuffing (Correct answer)
- Man-in-the-middle
Correct answer: Credential stuffing
Credential stuffing automates the testing of breached credential lists against login endpoints to exploit password reuse.
Question 7: When conducting a Business Impact Analysis (BIA) for a CIAM system, what is the MOST critical output?
- A list of all IAM vendors considered
- Recovery Time Objective (RTO) and Recovery Point Objective (RPO) for the identity service (Correct answer)
- The total number of user accounts in the system
- A mapping of all application integrations
Correct answer: Recovery Time Objective (RTO) and Recovery Point Objective (RPO) for the identity service
The BIA's most critical output is defining RTO and RPO, which drives recovery planning for the identity service.
CIAM Security and Risk Management 2
Which risk treatment option involves purchasing cyber liability insurance to cover potential losses from an identity breach?