CSC Identity and Access Management (IAM) Compliance 2 — Questions and Answers
Question 1: What does identity lifecycle management encompass in an IAM compliance program?
- The process of managing only physical ID badges for employees
- The end-to-end management of user identities from creation through modification to deprovisioning (Correct answer)
- A system for tracking employee anniversary dates
- A method for managing software license assignments only
Correct answer: The end-to-end management of user identities from creation through modification to deprovisioning
Identity lifecycle management covers the complete process of provisioning, modifying, and deprovisioning user accounts and access rights throughout an employee's tenure to maintain compliance.
Question 2: What is the primary compliance benefit of implementing Single Sign-On (SSO)?
- It requires users to log in separately to each application, creating more audit events
- It eliminates all passwords, removing authentication entirely from the environment
- It centralizes authentication and creates a unified audit trail across multiple systems (Correct answer)
- It is a backup authentication method used only when primary methods fail
Correct answer: It centralizes authentication and creates a unified audit trail across multiple systems
SSO centralizes authentication events into a single log source, making it easier to audit access across multiple systems and satisfying compliance requirements for access monitoring.
Question 3: What is the core IAM principle of the Zero Trust security model?
- Trust all users and devices located within the corporate network perimeter
- Never trust, always verify — every access request must be authenticated and authorized regardless of location (Correct answer)
- Grant maximum access upfront to accelerate business operations
- Only verify users during their initial onboarding to the organization
Correct answer: Never trust, always verify — every access request must be authenticated and authorized regardless of location
Zero Trust eliminates implicit trust based on network location, requiring continuous verification of every user and device for every access request, aligning with modern compliance mandates.
Question 4: What is Just-in-Time (JIT) access provisioning and why does it support compliance?
- Granting permanent access to all systems immediately upon a user's first login
- Providing elevated access only for the duration of a specific task and automatically revoking it afterward (Correct answer)
- Scheduling system access based on predetermined employee work shifts
- Providing admin access just before scheduled system maintenance windows
Correct answer: Providing elevated access only for the duration of a specific task and automatically revoking it afterward
JIT provisioning grants elevated permissions only when needed and revokes them immediately after, minimizing the window of standing privileged access and reducing compliance risk.
Question 5: Which access control model grants permissions based on security labels assigned to resources and user clearance levels?
- Role-Based Access Control (RBAC)
- Discretionary Access Control (DAC)
- Mandatory Access Control (MAC) (Correct answer)
- Attribute-Based Access Control (ABAC)
Correct answer: Mandatory Access Control (MAC)
MAC enforces access based on predefined security classifications (labels) and user clearance levels, with no user discretion allowed, commonly used in government and defense environments.
Question 6: What is federated identity management and how does it support compliance?
- A system where each application maintains its own completely separate user database
- A framework that enables identity information to be shared securely across organizational boundaries using trust relationships (Correct answer)
- A method restricting access exclusively to federal government personnel
- An approach requiring unique, separate credentials for every third-party vendor system
Correct answer: A framework that enables identity information to be shared securely across organizational boundaries using trust relationships
Federated identity management uses trust frameworks (such as SAML or OAuth) to share identity assertions across organizations, enabling secure access while maintaining centralized audit and governance.
Question 7: Why is comprehensive access event logging considered a critical IAM compliance control?
- Access logging is not specifically required by any major compliance framework
- It creates an audit trail documenting who accessed what resources and when, supporting forensic investigations and compliance audits (Correct answer)
- It serves exclusively to monitor employee productivity metrics
- It is only required for privileged administrator accounts, not standard users
Correct answer: It creates an audit trail documenting who accessed what resources and when, supporting forensic investigations and compliance audits
Access event logging creates an immutable audit trail of authentication and authorization activity required by frameworks like PCI DSS, HIPAA, and SOX to demonstrate accountability and support incident investigation.
CSC Identity and Access Management (IAM) Compliance 2
What does identity lifecycle management encompass in an IAM compliance program?