CIAM Security and Risk Management 3 — Questions and Answers
Question 1: Which security principle ensures that a user's access rights are limited to only what is necessary to perform their job function?
- Separation of duties
- Least privilege (Correct answer)
- Defense in depth
- Need to know
Correct answer: Least privilege
Least privilege restricts user access rights to the minimum permissions required for their specific role or task.
Question 2: A CIAM administrator discovers that a third-party identity provider (IdP) has suffered a breach. What is the FIRST step to take?
- Notify all end users immediately
- Revoke or invalidate all active sessions and tokens issued by that IdP (Correct answer)
- Shut down the entire CIAM platform
- Conduct a penetration test
Correct answer: Revoke or invalidate all active sessions and tokens issued by that IdP
Revoking active sessions and tokens from the compromised IdP immediately stops attackers from leveraging stolen credentials.
Question 3: What is the significance of a 'threat actor' in risk management for CIAM systems?
- An internal developer who writes authentication code
- An entity or group with the intent and capability to exploit vulnerabilities (Correct answer)
- A regulatory body that audits IAM compliance
- An automated bot that monitors system uptime
Correct answer: An entity or group with the intent and capability to exploit vulnerabilities
A threat actor is any individual, group, or organization with the motivation and capability to attack a system.
Question 4: Which framework provides a structured approach to categorizing information systems and selecting security controls based on impact levels?
- ISO 27001
- NIST SP 800-53 (Correct answer)
- OWASP Top 10
- SOC 2 Type II
Correct answer: NIST SP 800-53
NIST SP 800-53 provides a catalog of security and privacy controls organized around system impact levels (Low, Moderate, High).
Question 5: An organization wants to verify that its CIAM security controls are working as designed. Which activity BEST accomplishes this?
- Reviewing vendor documentation
- Conducting a security control assessment or audit (Correct answer)
- Updating user account passwords
- Redeploying the CIAM platform
Correct answer: Conducting a security control assessment or audit
A security control assessment validates that implemented controls are operating effectively and meeting their intended objectives.
Question 6: What is 'attack surface' in the context of a CIAM platform?
- The total number of active user accounts
- The sum of all points where unauthorized users can attempt to enter or extract data (Correct answer)
- The bandwidth consumed during peak authentication traffic
- The number of third-party integrations
Correct answer: The sum of all points where unauthorized users can attempt to enter or extract data
The attack surface encompasses all the exposed endpoints, APIs, interfaces, and entry points that could be exploited by an attacker.
Question 7: Which type of risk assessment uses numerical values and statistical models to quantify potential losses?
- Qualitative risk assessment
- Quantitative risk assessment (Correct answer)
- Residual risk assessment
- Inherent risk assessment
Correct answer: Quantitative risk assessment
Quantitative risk assessments use financial metrics like Annual Loss Expectancy (ALE) to express risk in monetary terms.
CIAM Security and Risk Management 3
Which security principle ensures that a user's access rights are limited to only what is necessary to perform their job function?