Identity Lifecycle Management Flashcards

Which term describes the process of automatically creating user accounts and assigning entitlements when an employee joins an organization?

Answer: Provisioning

Provisioning is the automated or manual process of creating accounts and granting appropriate access rights when a user onboards.

The 'joiner-mover-leaver' model in identity lifecycle management refers to which three phases?

Answer: Hire, Transfer, Terminate

The joiner-mover-leaver model maps to hiring (joiner), role/department changes (mover), and termination (leaver) in an employee's lifecycle.

What is the primary risk associated with orphaned accounts in an identity management system?

Answer: Unauthorized access by former employees or attackers

Orphaned accounts belong to users who no longer require access, creating a security gap that former employees or attackers could exploit.

Which process ensures that user access rights remain accurate and aligned with current job roles over time?

Answer: Access certification/attestation

Access certification (attestation) is a periodic review process where managers confirm or revoke user entitlements to maintain least-privilege alignment.

When an employee transfers from the finance department to the IT department, which identity lifecycle best practice should be applied?

Answer: Remove finance entitlements and grant IT entitlements

When a mover changes roles, old entitlements must be revoked and new ones granted to prevent accumulation of excessive privileges (privilege creep).

What is 'privilege creep' in the context of identity lifecycle management?

Answer: The gradual accumulation of access rights beyond what a user's current role requires

Privilege creep occurs when users accumulate access permissions over time as roles change but old entitlements are never removed.

Which automated workflow capability is most critical for reducing the time-to-provision for new employees?

Answer: Role-based provisioning triggered by HR system events

Role-based provisioning triggered by HR system events automates account creation and entitlement assignment the moment a hire event occurs, minimizing delays.