CIAM Technology and Tools 2 — Questions and Answers
Question 1: Which protocol does SCIM (System for Cross-domain Identity Management) use as its transport layer?
- SOAP over HTTPS
- REST over HTTPS (Correct answer)
- LDAP over TLS
- RADIUS over UDP
Correct answer: REST over HTTPS
SCIM uses RESTful APIs over HTTPS to automate user provisioning and deprovisioning across systems.
Question 2: A company wants to enforce that users can only log in from corporate-managed devices. Which IAM feature addresses this?
- Password complexity policies
- Device trust / device attestation (Correct answer)
- Session timeout configuration
- Account lockout thresholds
Correct answer: Device trust / device attestation
Device trust or device attestation verifies that a device meets security standards before granting access.
Question 3: Which tool category is specifically designed to discover and manage non-human identities such as service accounts and API keys?
- Identity Governance and Administration (IGA)
- Machine Identity Management (MIM) (Correct answer)
- Access Certification platforms
- Customer IAM (CIAM) portals
Correct answer: Machine Identity Management (MIM)
Machine Identity Management tools are designed to discover, rotate, and govern non-human identities like service accounts and certificates.
Question 4: What is the primary purpose of a PAM (Privileged Access Management) vault?
- Storing user profile photos securely
- Securely storing and rotating privileged credentials (Correct answer)
- Issuing SAML assertions to service providers
- Managing OAuth 2.0 client registrations
Correct answer: Securely storing and rotating privileged credentials
A PAM vault stores privileged credentials centrally and can automatically rotate them to reduce the risk of credential theft.
Question 5: In the context of IAM, what does 'just-in-time (JIT) provisioning' mean?
- Provisioning users exactly 24 hours before their start date
- Creating user accounts dynamically at the moment of first login (Correct answer)
- Granting permanent access rights during onboarding
- Deprovisioning accounts immediately upon termination
Correct answer: Creating user accounts dynamically at the moment of first login
JIT provisioning creates or updates a user account automatically when the user first authenticates, often driven by SAML or OIDC assertions.
Question 6: Which IAM capability allows an administrator to review and approve or revoke user entitlements on a scheduled basis?
- Single Sign-On (SSO)
- Access certification / access review (Correct answer)
- Adaptive authentication
- Token introspection
Correct answer: Access certification / access review
Access certification (or access review) is a periodic process where managers confirm whether users should retain their current access rights.
Question 7: Which standard defines a common schema for representing user and group objects across identity systems?
- OAuth 2.0
- SCIM 2.0 (Correct answer)
- FIDO2
- WS-Federation
Correct answer: SCIM 2.0
SCIM 2.0 defines a standardized schema and REST API for user and group provisioning across cloud-based systems.
CIAM Technology and Tools 2
Which protocol does SCIM (System for Cross-domain Identity Management) use as its transport layer?