CIAM Security and Risk Management 3

Question 1

Which security principle ensures that a user's access rights are limited to only what is necessary to perform their job function?

Accepted Answer

Least privilege

Answer

Least privilege restricts user access rights to the minimum permissions required for their specific role or task.

Question 2

A CIAM administrator discovers that a third-party identity provider (IdP) has suffered a breach. What is the FIRST step to take?

Accepted Answer

Revoke or invalidate all active sessions and tokens issued by that IdP

Answer

Revoking active sessions and tokens from the compromised IdP immediately stops attackers from leveraging stolen credentials.

Question 3

What is the significance of a 'threat actor' in risk management for CIAM systems?

Accepted Answer

An entity or group with the intent and capability to exploit vulnerabilities

Answer

A threat actor is any individual, group, or organization with the motivation and capability to attack a system.

Question 4

Which framework provides a structured approach to categorizing information systems and selecting security controls based on impact levels?

Accepted Answer

NIST SP 800-53

Answer

NIST SP 800-53 provides a catalog of security and privacy controls organized around system impact levels (Low, Moderate, High).

Question 5

An organization wants to verify that its CIAM security controls are working as designed. Which activity BEST accomplishes this?

Accepted Answer

Conducting a security control assessment or audit

Answer

A security control assessment validates that implemented controls are operating effectively and meeting their intended objectives.

(CIAM) Certified Identity and Access Manager Practice Test