CIPT Identity, Access Management, and Authentication for Privacy 1 — Questions and Answers
Question 1: Which access control model grants permissions based on a user's role within the organization rather than their individual identity?
- Role-based access control (RBAC) (Correct answer)
- Discretionary access control (DAC)
- Mandatory access control (MAC)
- Attribute-based access control (ABAC)
Correct answer: Role-based access control (RBAC)
RBAC assigns permissions to roles (e.g., HR analyst, system admin), and users inherit those permissions by being assigned to a role, simplifying least-privilege enforcement.
Question 2: What is the 'principle of least privilege' as applied to personal data access?
- Users and systems should only have access to the personal data required to perform their specific function (Correct answer)
- Administrators should have read-only access to all data
- All employees should share a single account for simplicity
- Data should be accessible to anyone within the corporate network
Correct answer: Users and systems should only have access to the personal data required to perform their specific function
Least privilege minimizes the number of people and systems with access to personal data, reducing insider threat risk and limiting breach scope.
Question 3: An employee transfers to a new department. Which identity management process ensures their old access rights are removed and new ones are assigned?
- Access recertification or provisioning/deprovisioning workflow (Correct answer)
- Password reset
- Multi-factor authentication enrollment
- Single sign-on configuration
Correct answer: Access recertification or provisioning/deprovisioning workflow
A role-change provisioning workflow automatically deactivates the employee's previous role permissions and grants those appropriate to their new function.
Question 4: What privacy risk does 'orphaned accounts' (accounts of former employees that were not deprovisioned) create?
- Unauthorized access to personal data by individuals who no longer have a legitimate need (Correct answer)
- Increased password reset ticket volume
- Higher cloud storage costs
- Degraded single sign-on performance
Correct answer: Unauthorized access to personal data by individuals who no longer have a legitimate need
Orphaned accounts can be used by former employees or attackers to access personal data without authorization, directly violating data access controls.
Question 5: Which authentication method provides the strongest privacy protection by ensuring that even if a password is stolen, unauthorized access is prevented?
- Multi-factor authentication (MFA) (Correct answer)
- Long password requirements alone
- Security questions only
- IP address allowlisting alone
Correct answer: Multi-factor authentication (MFA)
MFA requires a second factor (e.g., TOTP code, hardware token) in addition to the password, significantly reducing the risk of unauthorized access from credential theft.
Question 6: What is the privacy advantage of using 'single sign-on' (SSO) federated identity over separate credentials for each application?
- Reduces the number of places where credentials and identity data are stored, lowering exposure (Correct answer)
- Allows users to access systems anonymously
- Eliminates the need for access control policies
- Requires no authentication for internal applications
Correct answer: Reduces the number of places where credentials and identity data are stored, lowering exposure
SSO centralizes authentication so that identity data is managed in one place, reducing credential sprawl, orphaned accounts, and the attack surface for identity-based breaches.
CIPT Identity, Access Management, and Authentication for Privacy 1
Which access control model grants permissions based on a user's role within the organization rather than their individual identity?