CIAM Security and Risk Management 2

Question 1

Which risk treatment option involves purchasing cyber liability insurance to cover potential losses from an identity breach?

Accepted Answer

Risk transference

Answer

Risk transference shifts the financial impact of a risk to a third party, such as an insurance provider.

Question 2

A CIAM system detects 500 failed login attempts from a single IP in one minute. Which control is BEST suited to address this threat?

Accepted Answer

Rate limiting and IP-based throttling

Answer

Rate limiting and IP-based throttling directly counters brute-force and credential-stuffing attacks at the network layer.

Question 3

What is the PRIMARY purpose of a Risk Register in an IAM security program?

Accepted Answer

To document, prioritize, and monitor identified risks

Answer

A Risk Register is a central repository for recording, assessing, prioritizing, and tracking risks and their treatment plans.

Question 4

An organization's CIAM platform stores PII for millions of customers. Which regulation primarily governs data breach notification requirements in the United States at the federal level for financial institutions?

Accepted Answer

GLBA Safeguards Rule

Answer

The GLBA Safeguards Rule (amended 2023) requires financial institutions to notify the FTC within 30 days of a breach affecting 500+ customers.

Question 5

What does 'inherent risk' mean in the context of IAM security assessments?

Accepted Answer

The risk level before any mitigating controls are in place

Answer

Inherent risk is the raw or untreated risk exposure that exists before any security controls are implemented.

(CIAM) Certified Identity and Access Manager Practice Test

(CIAM) Certified Identity and Access Manager Practice Test

CIAM Security and Risk Management 2