CSC Identity and Access Management (IAM) Compliance 3

Question 1

What compliance consideration specifically applies to biometric authentication data under U.S. and international regulations?

Accepted Answer

Biometric data is classified as sensitive personal data under laws like GDPR and Illinois BIPA, requiring consent, secure storage, and breach notification

Answer

Biometric data is immutable and uniquely identifies individuals, making it highly sensitive under GDPR, Illinois BIPA, and similar laws that require explicit consent, secure handling, and mandatory breach notification.

Question 2

Why do service accounts require special IAM compliance attention in an organization?

Accepted Answer

Service accounts are non-human accounts used by applications with often-elevated privileges that lack standard interactive controls like password rotation

Answer

Service accounts run automated processes with elevated privileges, rarely rotate credentials interactively, and are high-value attack targets, requiring special monitoring, vaulting, and compliance controls.

Question 3

Under SOX compliance, what specific IAM control is required for access to financial reporting systems?

Accepted Answer

Separation of duties and access controls preventing unauthorized modification of financial reporting data

Answer

SOX Section 404 requires documented internal controls over financial reporting, including separation of duties and access restrictions that prevent unauthorized users from altering financial data.

Question 4

What is an access certification (recertification) campaign?

Accepted Answer

A periodic review process where managers formally attest to the appropriateness of their employees' current access rights

Answer

Access certification is a formal compliance process where data owners and managers review, approve, or revoke existing user access rights to enforce least privilege and document accountability.

Question 5

What is the compliance-recommended approach to managing access for contractors and temporary workers?

Accepted Answer

Provide time-limited accounts scoped to specific project needs with automatic expiration dates

Answer

Contractors should receive accounts with access strictly scoped to their engagement and configured to expire automatically, applying least privilege and eliminating residual access after their engagement ends.

(CSC) Cybersecurity Compliance Certification Practice Test

(CSC) Cybersecurity Compliance Certification Practice Test

CSC Identity and Access Management (IAM) Compliance 3