CSC Identity and Access Management (IAM) Compliance 1 — Questions and Answers
Question 1: What does the principle of least privilege require in an IAM compliance context?
- Users should receive maximum permissions so they can complete any possible task
- Users should be granted only the minimum permissions necessary to perform their specific job functions (Correct answer)
- All users in the same department should share identical access levels
- System administrators should have unrestricted access to all organizational systems
Correct answer: Users should be granted only the minimum permissions necessary to perform their specific job functions
The principle of least privilege limits each user's access to only what is required for their role, minimizing the attack surface and reducing insider threat risk.
Question 2: Which compliance framework explicitly mandates multi-factor authentication (MFA) for all remote access to cardholder data environments?
- HIPAA Security Rule
- ISO 27001
- PCI DSS (Correct answer)
- Sarbanes-Oxley (SOX)
Correct answer: PCI DSS
PCI DSS Requirement 8.4 mandates MFA for all non-console administrative access and all remote access to the cardholder data environment (CDE).
Question 3: What is the primary compliance purpose of Privileged Access Management (PAM)?
- To grant all employees access to sensitive systems for operational efficiency
- To monitor, secure, and control elevated access to critical systems and data (Correct answer)
- To eliminate the need for administrator accounts entirely
- To provide faster system access for IT staff during incidents
Correct answer: To monitor, secure, and control elevated access to critical systems and data
PAM secures and monitors privileged accounts that have elevated rights, reducing the risk of insider threats and unauthorized access to critical resources.
Question 4: How frequently do most compliance frameworks (PCI DSS, SOX, ISO 27001) require access reviews to be conducted for privileged accounts?
- Once every five years
- Only when an employee is terminated
- At least quarterly for privileged accounts, with general access reviewed at minimum annually (Correct answer)
- Access reviews are not required by any compliance framework
Correct answer: At least quarterly for privileged accounts, with general access reviewed at minimum annually
Most compliance frameworks require periodic access reviews, with privileged access reviewed at least quarterly and standard user access reviewed at minimum annually to enforce least privilege.
Question 5: What does Role-Based Access Control (RBAC) use as the basis for assigning access permissions?
- The time of day a user logs in to the system
- The job roles defined within the organization (Correct answer)
- The user's personal request without formal approval
- The physical location from which the user is connecting
Correct answer: The job roles defined within the organization
RBAC assigns permissions based on defined organizational roles, ensuring users receive access appropriate to their job function, simplifying administration and supporting compliance.
Question 6: What is the compliance significance of Separation of Duties (SoD) in IAM?
- It allows users to share login credentials to improve team efficiency
- It requires critical tasks to be divided among multiple individuals to prevent fraud or errors (Correct answer)
- It separates the IT department physically from other business units
- It mandates using different passwords for every system a user accesses
Correct answer: It requires critical tasks to be divided among multiple individuals to prevent fraud or errors
Separation of duties ensures no single individual can control all aspects of a critical process, a key anti-fraud control required by frameworks like SOX, PCI DSS, and ISO 27001.
Question 7: Under most cybersecurity compliance frameworks, which combination of requirements applies to password policies?
- At least 4 characters with no additional restrictions
- Any combination the individual user prefers without organizational standards
- Minimum length, character complexity (uppercase, lowercase, numbers, special characters), and periodic rotation (Correct answer)
- Uppercase letters and numbers only, with no special characters
Correct answer: Minimum length, character complexity (uppercase, lowercase, numbers, special characters), and periodic rotation
Compliance frameworks require passwords to meet minimum length, include mixed character types, and be rotated periodically to reduce the risk of credential compromise.
CSC Identity and Access Management (IAM) Compliance 1
What does the principle of least privilege require in an IAM compliance context?