CIAM Security and Risk Management 5

Question 1

Which OWASP category directly addresses broken or misconfigured access control mechanisms in web-based CIAM applications?

Accepted Answer

Broken Access Control

Answer

Broken Access Control (OWASP A01:2021) covers failures where users can act outside their intended permissions.

Question 2

A CIAM risk assessment reveals that a specific threat has a high likelihood but a low impact. How should this risk TYPICALLY be prioritized?

Accepted Answer

Monitored and assigned a medium priority

Answer

High likelihood combined with low impact generally places a risk in the medium priority range, requiring monitoring but not emergency response.

Question 3

Which authentication security control directly reduces the risk of credential theft by ensuring passwords are never stored in plaintext?

Accepted Answer

Password hashing with salt using bcrypt or Argon2

Answer

Salted hashing with algorithms like bcrypt or Argon2 ensures that even if the database is breached, plaintext passwords cannot be recovered.

Question 4

What is the purpose of a 'tabletop exercise' in the context of CIAM incident response planning?

Accepted Answer

To simulate a security incident scenario and walk through response procedures verbally

Answer

A tabletop exercise is a discussion-based simulation where participants talk through their response to a hypothetical incident without real-world execution.

Question 5

In zero-trust architecture applied to CIAM, which statement BEST describes the core security assumption?

Accepted Answer

No user or device is trusted by default, and every access request must be continuously verified

Answer

Zero trust operates on the principle of 'never trust, always verify,' requiring continuous validation of every access request regardless of network location.

(CIAM) Certified Identity and Access Manager Practice Test

(CIAM) Certified Identity and Access Manager Practice Test

CIAM Security and Risk Management 5