CIAM – Certified Identity and Access Manager — Questions and Answers

Question 1: Under HIPAA, which entity must sign a Business Associate Agreement (BAA) with a covered entity?

Any vendor the covered entity pays
Vendors who handle protected health information on behalf of the covered entity (Correct answer)
Vendors located outside the United States
Vendors providing cloud infrastructure only

Correct answer: Vendors who handle protected health information on behalf of the covered entity

A BAA is required for any business associate that creates, receives, maintains, or transmits PHI on behalf of a HIPAA covered entity.

Question 2: What is the purpose of the audience restriction in a SAML assertion?

To specify which Service Provider is authorized to consume the assertion (Correct answer)
To limit the token's validity period
To restrict authentication to certain geographic regions
To limit the number of concurrent users

Correct answer: To specify which Service Provider is authorized to consume the assertion

The audience restriction in a SAML assertion specifies which Service Provider(s) may use it, preventing a valid assertion from being replayed at an unintended service.

Question 3: What does WS-Federation stand for?

Wide-Scale Federation
Workstation Security Federation
Web Standard Federation
Web Services Federation (Correct answer)

Correct answer: Web Services Federation

WS-Federation (Web Services Federation) is a Microsoft-developed protocol that enables identity and security information sharing across different security domains.

Question 4: What is 'Just-In-Time (JIT) provisioning' in SSO?

Provisioning accounts based on time-zone requirements
Automatically creating user accounts upon the user's first successful SSO authentication (Correct answer)
Performing real-time password synchronization across systems
Scheduling user account creation in advance

Correct answer: Automatically creating user accounts upon the user's first successful SSO authentication

JIT provisioning automatically creates a user account in the Service Provider the moment a user first successfully authenticates via SSO, eliminating manual pre-provisioning.

Question 5: Which of the following best describes 'address of record' verification in identity proofing?

Checking that a mailing address is formatted correctly
Confirming a physical or digital address associated with the applicant to establish contact and identity (Correct answer)
Validating that an email address is not on a blocklist
Verifying that a user's IP address matches their registered country

Correct answer: Confirming a physical or digital address associated with the applicant to establish contact and identity

Address of record verification confirms a physical or digital address tied to the individual, typically through enrollment codes sent by mail or verified credit bureau records, establishing a real-world connection.

Question 6: What is the primary function of an Access Control Policy in IAM governance?

To store backup copies of user data
To define and enforce rules for user authentication and access to resources (Correct answer)
To provide employees with access to training resources
To create detailed user reports

Correct answer: To define and enforce rules for user authentication and access to resources

An Access Control Policy defines the rules governing how users authenticate and what resources they can access within an organization. It ensures that only authorized users are granted access to specific systems or data, in accordance with governance and compliance requirements.

Question 7: Which authorization model assigns permissions based on a user's job function within an organization?

Mandatory Access Control (MAC)
Attribute-Based Access Control (ABAC)
Role-Based Access Control (RBAC) (Correct answer)
Discretionary Access Control (DAC)

Correct answer: Role-Based Access Control (RBAC)

Role-Based Access Control (RBAC) grants permissions based on roles assigned to users, where roles correspond to job functions or responsibilities within the organization.

Question 8: What is 'orphan account' detection in IAM?

Detecting anonymous guest accounts in directory services
Identifying active accounts that remain after the associated employee has left or changed roles (Correct answer)
Finding user accounts that lack assigned passwords
Finding shared service accounts with no designated owner

Correct answer: Identifying active accounts that remain after the associated employee has left or changed roles

Orphan account detection identifies accounts that remain enabled after the associated user has been terminated or transferred, reducing the attack surface from stale credentials.

Question 9: A CIAM platform uses JSON Web Tokens (JWTs) for session management. Which vulnerability arises when JWT signature verification is bypassed by setting the algorithm to 'none'?

Session fixation
Algorithm confusion attack (Correct answer)
Token replay attack
Cross-site request forgery

Correct answer: Algorithm confusion attack

The 'alg:none' algorithm confusion attack allows attackers to forge tokens by stripping signature validation entirely.

Question 10: What does the 'tombstoneLifetime' attribute in Active Directory control?

The maximum age of Kerberos tickets
How long deleted objects are retained before being permanently purged (Correct answer)
The time limit for password resets
How long a user account remains disabled before deletion

Correct answer: How long deleted objects are retained before being permanently purged

Tombstone lifetime defines how long deleted objects remain in the directory (default 180 days) so replication can propagate deletions before the object is fully purged.

Question 11: What is a zero-day vulnerability?

A low-risk security issue
A security flaw unknown to the vendor with no available patch (Correct answer)
A vulnerability that was fixed immediately
An outdated software version

Correct answer: A security flaw unknown to the vendor with no available patch

Zero-day vulnerabilities are newly discovered security flaws that the vendor doesn't know about yet, giving them 'zero days' to fix it before potential exploitation.

Question 12: Knowledge-Based Authentication (KBA) used during identity proofing is primarily intended to:

Encrypt knowledge factors for secure storage
Verify that a claimant has knowledge of information associated with their identity (Correct answer)
Replace multi-factor authentication for high-assurance systems
Generate one-time passwords for remote access

Correct answer: Verify that a claimant has knowledge of information associated with their identity

KBA leverages questions about information associated with an individual (e.g., previous addresses, financial records) to provide additional evidence that the claimant controls the identity they are asserting.

Question 13: An enterprise deploys an adaptive authentication policy that increases friction when a user logs in from a new country. This approach is best described as:

Password complexity enforcement
Static MFA enforcement
Certificate-based authentication
Risk-based or contextual authentication (Correct answer)

Correct answer: Risk-based or contextual authentication

Risk-based (contextual) authentication dynamically adjusts the authentication challenge based on contextual risk signals such as location, device, and behavior anomalies.

Question 14: Which OWASP category directly addresses broken or misconfigured access control mechanisms in web-based CIAM applications?

Broken Access Control (Correct answer)
Cryptographic Failures
Injection
Security Misconfiguration

Correct answer: Broken Access Control

Broken Access Control (OWASP A01:2021) covers failures where users can act outside their intended permissions.

Question 15: What is a firewall?

A password manager
A fire-resistant building component
A security device that monitors and controls network traffic based on rules (Correct answer)
An antivirus program

Correct answer: A security device that monitors and controls network traffic based on rules

Firewalls filter incoming and outgoing network traffic based on security rules, creating a barrier between trusted and untrusted networks.

Question 16: What is a common method for conducting a security audit within an IAM framework?

Reviewing access logs to ensure compliance with access control policies (Correct answer)
Implementing a backup solution for user data
Changing user passwords every 30 days
Assigning roles to users based on their access needs

Correct answer: Reviewing access logs to ensure compliance with access control policies

A common method for conducting a security audit within an IAM framework involves reviewing access logs. These logs provide a detailed record of who accessed what, when, and how, allowing organizations to verify compliance with access control policies and detect any unauthorized or suspicious activity.

Question 17: What is a SIEM system in the context of IAM monitoring?

A Single Identity Entry Module for centralizing accounts
A Security Information and Event Management system that aggregates and correlates security logs (Correct answer)
A password management system for enterprise users
A certificate authority for issuing identity certificates

Correct answer: A Security Information and Event Management system that aggregates and correlates security logs

A SIEM aggregates security logs from multiple sources, correlates events using rules and analytics, and provides real-time alerting for potential security incidents including IAM anomalies.

Question 18: In certificate-based authentication, what cryptographic artifact does the client present to prove identity?

A digital certificate containing the client's public key (Correct answer)
A hashed copy of the client's password
A SAML assertion from the IdP
A session cookie signed by the server

Correct answer: A digital certificate containing the client's public key

Certificate-based authentication requires the client to present a digital certificate (e.g., X.509) containing its public key, signed by a trusted Certificate Authority.

Question 19: NIST SP 800-63A's IAL3 (Identity Assurance Level 3) requires which verification method not mandated at IAL2?

Remote document scanning
Knowledge-based authentication
Self-assertion of identity attributes
In-person proofing with a trained operator or Trusted Referee (Correct answer)

Correct answer: In-person proofing with a trained operator or Trusted Referee

IAL3 requires in-person proofing (or an equivalent supervised remote session) conducted by a trained operator, providing the highest level of confidence in the identity being established.

Question 20: The GDPR principle of 'data minimization' most directly influences which IAM practice?

Identity federation across domains
Password complexity requirements
Single sign-on implementation
Least privilege access provisioning (Correct answer)

Correct answer: Least privilege access provisioning

Data minimization aligns with least privilege by ensuring users only access the minimum data necessary for their role.

Question 21: In the context of IAM governance, a Segregation of Duties (SoD) violation occurs when:

A role contains more than 50 permissions
A user holds access rights that span the full lifecycle of a critical transaction (Correct answer)
A user activates more than one role in a session
An administrator grants access without approval

Correct answer: A user holds access rights that span the full lifecycle of a critical transaction

SoD violations exist when one person can initiate, approve, and complete a sensitive transaction without any checks, enabling fraud or error without detection.

Question 22: What is 'Privileged Session Management' (PSM)?

A tool for managing end-user session timeouts
A capability that records, monitors, and controls sessions conducted by privileged users in real time (Correct answer)
A browser session management tool for IT help desk staff
A system for managing user authentication session tokens

Correct answer: A capability that records, monitors, and controls sessions conducted by privileged users in real time

Privileged Session Management records all keystrokes and actions during privileged user sessions, enabling real-time monitoring, intervention, and forensic replay after incidents.

Question 23: What does 'ephemeral credentials' mean in the context of cloud privileged access?

Credentials shared among multiple cloud services
Short-lived, automatically expiring secrets generated on demand (Correct answer)
Permanent API keys rotated annually
Credentials stored in encrypted form indefinitely

Correct answer: Short-lived, automatically expiring secrets generated on demand

Ephemeral credentials are temporary secrets with a short TTL, drastically reducing the risk window if they are compromised.

Question 24: A healthcare organization must ensure that only authorized workforce members access ePHI based on their job function. Which HIPAA concept does this describe?

Minimum necessary standard (Correct answer)
Role-based access control
Break-glass access procedure
De-identification of PHI

Correct answer: Minimum necessary standard

The HIPAA Minimum Necessary standard requires covered entities to limit access to ePHI to only what is needed for the workforce member's job function.

Question 25: In XACML (eXtensible Access Control Markup Language), what component makes the actual access decision?

Policy Enforcement Point (PEP)
Policy Administration Point (PAP)
Policy Information Point (PIP)
Policy Decision Point (PDP) (Correct answer)

Correct answer: Policy Decision Point (PDP)

The PDP evaluates applicable policies against the access request and returns Permit, Deny, NotApplicable, or Indeterminate decisions.

Question 26: Which attribute in Active Directory stores the last time a user successfully authenticated, and why is it sometimes disabled in large environments?

accountExpires, because frequent updates exhaust the RID pool
lastLogon, because it is domain-controller-local and not replicated (Correct answer)
pwdLastSet, because storing login times violates privacy regulations
lastLogonTimestamp, because it is updated too frequently and causes excessive replication

Correct answer: lastLogon, because it is domain-controller-local and not replicated

lastLogon is updated on every authentication but is NOT replicated between domain controllers, so each DC holds only its own view; lastLogonTimestamp is replicated but intentionally delayed.

Question 27: When implementing LDAP in a CIAM solution, what is the primary security concern with using simple bind authentication?

Credentials are transmitted in cleartext unless TLS is also enforced (Correct answer)
Simple bind sessions expire too quickly for consumer applications
Simple bind does not support multi-factor authentication
Simple bind accounts cannot be assigned granular directory permissions

Correct answer: Credentials are transmitted in cleartext unless TLS is also enforced

Simple bind sends the DN and password in plaintext over the network, making it vulnerable to credential interception unless the connection is protected by TLS/LDAPS.

Question 28: Which IAM architectural decision addresses the risk of a single identity provider outage affecting access to all dependent applications?

Using mandatory access control across all applications
Implementing multi-factor authentication at the application layer
Deploying a high-availability IdP cluster with failover capabilities (Correct answer)
Encrypting all SAML assertions with application-specific keys

Correct answer: Deploying a high-availability IdP cluster with failover capabilities

High-availability IdP deployment with clustering and geographic failover ensures authentication services remain available even if individual nodes fail.

Question 29: A company implements access control where a manager can temporarily grant their permissions to a delegate while on leave. This is an example of:

Role inheritance
Privilege escalation
Permission delegation (Correct answer)
Dynamic SSD

Correct answer: Permission delegation

Permission delegation allows an authorized user to temporarily transfer a subset of their permissions to another user, common in workflow and identity governance systems.

Question 30: Which NIST RBAC model level adds role hierarchies to the flat RBAC model?

Constrained RBAC
Hierarchical RBAC (Correct answer)
Symmetric RBAC
Core RBAC

Correct answer: Hierarchical RBAC

Hierarchical RBAC (NIST Level 2) adds senior/junior role relationships where senior roles inherit all permissions of junior roles, enabling permission reuse.

Question 31: The principle of 'context-aware authentication' requires that authentication strength be determined by which factor?

Risk signals such as device posture, location, and behavior (Correct answer)
The classification level of the directory server being queried
The number of characters in the user's password
The user's seniority level within the organization

Correct answer: Risk signals such as device posture, location, and behavior

Context-aware (risk-based) authentication dynamically adjusts the required assurance level based on environmental risk signals at the time of login.

Question 32: A SOC 2 Type II report differs from SOC 2 Type I primarily in that it:

Is intended for regulatory bodies rather than customers
Requires third-party penetration testing
Covers additional trust service criteria
Evaluates controls over a period of time rather than a point in time (Correct answer)

Correct answer: Evaluates controls over a period of time rather than a point in time

SOC 2 Type II evaluates the operational effectiveness of controls over a defined period (typically 6–12 months), while Type I assesses design at a single point in time.

Question 33: What does 'log integrity' mean in IAM auditing?

Ensuring audit logs are human-readable and well-formatted
Protecting audit records from modification or deletion to preserve their evidentiary trustworthiness (Correct answer)
Compressing log files to reduce storage requirements
Synchronizing log timestamps across distributed systems

Correct answer: Protecting audit records from modification or deletion to preserve their evidentiary trustworthiness

Log integrity ensures audit records cannot be altered after creation, typically enforced through cryptographic controls, write-once storage, or tamper-evident log chains.

Question 34: What is multi-factor authentication (MFA)?

Logging in from multiple devices
Using multiple passwords
Requiring two or more verification methods to confirm identity (Correct answer)
Having multiple accounts

Correct answer: Requiring two or more verification methods to confirm identity

MFA combines two or more authentication factors (something you know, have, or are) for stronger identity verification.

Question 35: What is the key distinction between IAL1 and IAL2 per NIST SP 800-63A?

IAL1 allows self-asserted identity with no proofing while IAL2 requires validated identity evidence (Correct answer)
IAL1 is for federal systems while IAL2 applies to commercial entities
IAL1 mandates biometrics while IAL2 uses knowledge factors only
IAL1 requires multi-factor authentication while IAL2 uses single-factor

Correct answer: IAL1 allows self-asserted identity with no proofing while IAL2 requires validated identity evidence

At IAL1, there is no requirement to link the applicant's claimed identity to the real world; at IAL2, the identity must be supported by validated and verified evidence.

Question 36: What is encryption?

Compressing files
Converting data into coded format to prevent unauthorized access (Correct answer)
Deleting data
Backing up data

Correct answer: Converting data into coded format to prevent unauthorized access

Encryption transforms readable data into unreadable ciphertext using algorithms and keys, ensuring only authorized parties can access the information.

Question 37: What protocol is commonly used for federated identity management to exchange authentication and authorization data between parties?

SAML (Correct answer)
SNMP
LDAP
RADIUS

Correct answer: SAML

SAML (Security Assertion Markup Language) is the standard XML-based protocol for exchanging authentication and authorization data in federated identity systems.

Question 38: Which CIS Control directly maps to managing access based on the principle of least privilege?

CIS Control 5 – Account Management
CIS Control 6 – Access Control Management (Correct answer)
CIS Control 12 – Network Infrastructure Management
CIS Control 1 – Inventory of Enterprise Assets

Correct answer: CIS Control 6 – Access Control Management

CIS Control 6 focuses on Access Control Management, including least privilege, limiting administrative rights, and centralizing access management.

Question 39: An organization wants to verify that its CIAM security controls are working as designed. Which activity BEST accomplishes this?

Updating user account passwords
Conducting a security control assessment or audit (Correct answer)
Redeploying the CIAM platform
Reviewing vendor documentation

Correct answer: Conducting a security control assessment or audit

A security control assessment validates that implemented controls are operating effectively and meeting their intended objectives.

Question 40: Which IGA concept describes assigning access based on a user's verified attributes such as department, location, and clearance level?

Discretionary Access Control (DAC)
Attribute-Based Access Control (ABAC) (Correct answer)
Role-Based Access Control (RBAC)
Mandatory Access Control (MAC)

Correct answer: Attribute-Based Access Control (ABAC)

ABAC grants access dynamically based on evaluated attributes of the user, resource, and environment, enabling fine-grained, contextual access decisions.

Question 41: Which ISO standard specifically addresses information security management systems (ISMS) and is directly relevant to IAM program governance?

ISO/IEC 27018
ISO 31000
ISO/IEC 29101
ISO/IEC 27001 (Correct answer)

Correct answer: ISO/IEC 27001

ISO/IEC 27001 specifies requirements for establishing, implementing, maintaining, and continually improving an ISMS, which includes IAM controls.

Question 42: Which OAuth 2.0 grant type is specifically designed for machine-to-machine (M2M) communication where no user is involved?

Authorization Code
Resource Owner Password Credentials
Client Credentials (Correct answer)
Device Authorization

Correct answer: Client Credentials

The Client Credentials grant type allows a client to authenticate with the authorization server using its own credentials and obtain an access token without user involvement.

Question 43: Which OAuth 2.0 flow is recommended for server-to-server authentication without user interaction?

Client Credentials Flow (Correct answer)
Implicit Flow
Authorization Code Flow
Device Authorization Flow

Correct answer: Client Credentials Flow

The Client Credentials Flow is designed for machine-to-machine authentication where no user is present and only client credentials are used.

Question 44: Which authentication security control directly reduces the risk of credential theft by ensuring passwords are never stored in plaintext?

Single sign-on federation
Session token expiration
Multi-factor authentication
Password hashing with salt using bcrypt or Argon2 (Correct answer)

Correct answer: Password hashing with salt using bcrypt or Argon2

Salted hashing with algorithms like bcrypt or Argon2 ensures that even if the database is breached, plaintext passwords cannot be recovered.

Question 45: What is 'scope downscoping' in OAuth 2.0 token exchange (RFC 8693)?

Automatically expanding scopes when access tokens are refreshed
Issuing a new token with a reduced set of scopes from the original token (Correct answer)
Removing expired scopes from the authorization server's policy
Requesting scopes that exceed the client's registered permissions

Correct answer: Issuing a new token with a reduced set of scopes from the original token

Scope downscoping in token exchange means the newly issued token has fewer or more restricted scopes than the original token, applying least-privilege for specific delegated operations.

Question 46: Which of the following is a key feature of an LDAP (Lightweight Directory Access Protocol) server in IAM?

It tracks user activity on web applications
It stores and retrieves identity-related information (Correct answer)
It encrypts communications between users and servers
It authenticates users by verifying biometric data

Correct answer: It stores and retrieves identity-related information

An LDAP (Lightweight Directory Access Protocol) server is a type of directory service widely used in IAM to store and retrieve identity-related information. It provides a centralized, hierarchical database for managing user accounts, groups, and other network resources, facilitating authentication and authorization.

Question 47: An IAM policy exception process should require which of the following before granting a temporary deviation from policy?

Documented business justification, risk acceptance, and a defined expiration date (Correct answer)
Proof of compliance with all other policies
Sign-off from the internal audit team
Executive sponsorship only

Correct answer: Documented business justification, risk acceptance, and a defined expiration date

A sound exception process requires documented justification, formal risk acceptance by an appropriate owner, and an expiration so exceptions do not become permanent.

Question 48: A company subject to SOX must ensure that financial system access controls are tested by:

An independent auditor as part of ICFR testing (Correct answer)
The CISO on a quarterly basis
The IAM team using automated scans only
The system owner annually

Correct answer: An independent auditor as part of ICFR testing

SOX Section 404 requires management assessment and independent auditor testing of internal controls over financial reporting (ICFR), including access controls.

Question 49: What LDAP control (OID 1.2.840.113556.1.4.319) enables a client to page through large search result sets?

Simple Paged Results control (Correct answer)
Server-side Sorting control
VLV (Virtual List View) control
Sort control

Correct answer: Simple Paged Results control

The Simple Paged Results control (RFC 2696) allows clients to retrieve large search results in manageable pages by passing a cookie back and forth with the server.

Question 50: During remote identity proofing at IAL2, which of the following is typically required?

In-person biometric capture at a government office
Submission of a handwritten notarized affidavit
An existing federated identity from a social media provider
Automated validation of identity document images and a selfie comparison (Correct answer)

Correct answer: Automated validation of identity document images and a selfie comparison

Remote IAL2 proofing typically requires the applicant to capture images of a government-issued identity document and a selfie, which are then validated and compared using automated systems.

Question 51: A company wants to enforce that users can only log in from corporate-managed devices. Which IAM feature addresses this?

Device trust / device attestation (Correct answer)
Session timeout configuration
Account lockout thresholds
Password complexity policies

Correct answer: Device trust / device attestation

Device trust or device attestation verifies that a device meets security standards before granting access.

Question 52: When a CIAM system uses LDAP as a user store, which best practice ensures high availability for authentication requests?

Disable LDAP referrals so all requests are handled by the primary server
Configure a single master LDAP server with daily backups
Use read-write connections to only one server to avoid replication conflicts
Deploy multiple LDAP replicas and configure the CIAM platform with failover or load-balanced connections (Correct answer)

Correct answer: Deploy multiple LDAP replicas and configure the CIAM platform with failover or load-balanced connections

Multiple read replicas behind a load balancer or using a failover list ensures authentication continues even if one LDAP server becomes unavailable.

Question 53: Which metric measures the average time it takes an organization to detect a security breach within its CIAM environment?

Mean Time to Detect (MTTD) (Correct answer)
Recovery Time Objective (RTO)
Annual Loss Expectancy (ALE)
Mean Time to Repair (MTTR)

Correct answer: Mean Time to Detect (MTTD)

MTTD (Mean Time to Detect) measures the average elapsed time between a breach occurring and the organization identifying it.

Question 54: An organization wants to demonstrate continuous compliance with access control requirements. Which approach best achieves this compared to point-in-time audits?

Increasing the frequency of manual access reviews to monthly
Requiring employees to self-certify their access annually
Implementing automated, real-time control monitoring with alerting (Correct answer)
Hiring additional auditors to conduct more assessments

Correct answer: Implementing automated, real-time control monitoring with alerting

Automated real-time monitoring continuously validates that controls are in place and immediately flags violations, providing a stronger assurance posture than periodic reviews.

Question 55: Which principle states that a privileged user should only be able to access systems relevant to their specific administrative function?

Defense in depth
Least privilege
Separation of duties
Need-to-know (Correct answer)

Correct answer: Need-to-know

Need-to-know restricts access to information or systems based on whether access is necessary for the user's defined job function.

Question 56: What is the purpose of an IAM security dashboard?

Tracking software license counts and renewal dates
Displaying marketing performance metrics for identity products
Providing real-time visibility into identity and access health, risk indicators, and compliance status (Correct answer)
Managing server hardware resources and performance metrics

Correct answer: Providing real-time visibility into identity and access health, risk indicators, and compliance status

IAM dashboards consolidate key metrics such as failed logins, policy violations, orphan accounts, and certification status into a unified view for administrators.

Question 57: What is a 'toxic combination' in access management?

Conflicting firewall rules that block legitimate federation traffic
A set of access rights that together create an unacceptable security or fraud risk when held by one person (Correct answer)
A dangerous password pattern identified by policy scanning
Incompatible identity management software products

Correct answer: A set of access rights that together create an unacceptable security or fraud risk when held by one person

A toxic combination is a set of permissions that, when granted to the same individual, violates segregation of duties — for example, having both payment creation and payment approval rights.

Question 58: What is the default port for LDAPS (LDAP over SSL/TLS)?

3268
636 (Correct answer)
3269
389

Correct answer: 636

LDAPS uses TCP port 636 for standard domain connections, while port 3269 is used for LDAPS connections to the Global Catalog.

Question 59: What is the difference between authentication logging and authorization logging?

Authentication logging is encrypted while authorization logging is stored in plain text
Authentication logging records identity verification events; authorization logging records access control decisions (Correct answer)
There is no meaningful difference between the two types
Authorization logging records password changes while authentication logging records role assignments

Correct answer: Authentication logging records identity verification events; authorization logging records access control decisions

Authentication logging captures login and logout events that verify identity, while authorization logging records access control decisions — what resources were allowed or denied to authenticated users.

Question 60: What is the CIA triad in information security?

Certified Information Auditor
Central Intelligence Agency
Confidentiality, Integrity, Availability (Correct answer)
Cybersecurity Infrastructure Act

Correct answer: Confidentiality, Integrity, Availability

The CIA triad represents three core security principles: Confidentiality (keeping data private), Integrity (data accuracy), Availability (systems accessible when needed).

Question 61: What is the purpose of access certification campaigns?

Issuing digital identity certificates to new employees
Certifying IAM administrators through formal examinations
Periodically verifying that users retain only appropriate access rights by having managers review and approve (Correct answer)
Testing IAM system performance under peak load conditions

Correct answer: Periodically verifying that users retain only appropriate access rights by having managers review and approve

Access certification campaigns periodically require managers or system owners to review and confirm that each user's access rights remain appropriate for their current role.

Question 62: What is the primary goal of risk assessment in identity and access management (IAM)?

To define the company’s network topology
To assign passwords to users
To identify and fix vulnerabilities in user authentication
To evaluate the potential threats to an organization's data and systems (Correct answer)

Correct answer: To evaluate the potential threats to an organization's data and systems

The primary goal of risk assessment in IAM is to systematically identify, analyze, and evaluate potential threats and vulnerabilities related to identity and access. This process helps organizations understand the likelihood and impact of security incidents, enabling them to implement appropriate safeguards to protect data and systems.

Question 63: Which identity governance concept ensures that a user's access rights are reviewed and confirmed by an authoritative party at regular intervals?

Entitlement harvesting
Access certification (Correct answer)
Role mining
Segregation of duties

Correct answer: Access certification

Access certification (access review/recertification) is the periodic process of validating that users still require their current access rights.

Question 64: What is the significance of 'time-stamping' in IAM audit logs?

It determines user session timeout intervals
It manages password expiration schedules
It establishes the sequence and timing of events, which is critical for forensic investigation and compliance (Correct answer)
It controls when access certification campaigns are triggered

Correct answer: It establishes the sequence and timing of events, which is critical for forensic investigation and compliance

Accurate timestamps in audit logs establish the precise sequence of events, which is essential for reconstructing incidents, proving compliance, and correlating events across systems.

Question 65: What distinguishes 'coarse-grained' authorization from 'fine-grained' authorization?

Fine-grained authorization is only applicable to RBAC systems
Coarse-grained controls access at a broad level (e.g., API access) while fine-grained controls specific data or operations (Correct answer)
Coarse-grained authorization is evaluated at the resource server; fine-grained at the client
Coarse-grained uses cryptographic tokens while fine-grained uses session cookies

Correct answer: Coarse-grained controls access at a broad level (e.g., API access) while fine-grained controls specific data or operations

Coarse-grained authorization makes broad allow/deny decisions (e.g., can access the HR API), while fine-grained authorization makes detailed decisions (e.g., can view salary data only for direct reports).

Question 66: In an IAM context, what is a 'connector' or 'agent' in provisioning tools?

A policy enforcement point in a network
A hardware token used for MFA
A firewall rule allowing identity traffic
A software component that translates IAM commands to a target system's native API (Correct answer)

Correct answer: A software component that translates IAM commands to a target system's native API

A connector or provisioning agent adapts the IAM platform's generic provisioning requests to the specific APIs or protocols of the target application.

Question 67: What is the purpose of a recertification campaign in IAM?

Renewing SSL/TLS certificates used in the IAM infrastructure
Restarting IAM services to apply configuration changes
Recertifying IAM administrators' professional credentials
Periodically requiring managers to review and reconfirm that team members' access rights remain appropriate (Correct answer)

Correct answer: Periodically requiring managers to review and reconfirm that team members' access rights remain appropriate

Recertification campaigns mandate that access rights be actively reconfirmed on a scheduled basis, rather than remaining in place indefinitely once granted.

Question 68: Which OAuth 2.0 token type is a short-lived credential used to access protected resources on behalf of a user?

Access token (Correct answer)
Authorization code
ID token
Refresh token

Correct answer: Access token

An access token is a short-lived credential presented by the client to the resource server to access protected resources on behalf of the resource owner.

Question 69: When conducting a Business Impact Analysis (BIA) for a CIAM system, what is the MOST critical output?

A list of all IAM vendors considered
A mapping of all application integrations
Recovery Time Objective (RTO) and Recovery Point Objective (RPO) for the identity service (Correct answer)
The total number of user accounts in the system

Correct answer: Recovery Time Objective (RTO) and Recovery Point Objective (RPO) for the identity service

The BIA's most critical output is defining RTO and RPO, which drives recovery planning for the identity service.

Question 70: Which approach best handles identity lifecycle management for a large organization with multiple HR systems across subsidiaries?

Allow each subsidiary to independently manage its own IAM with no central oversight
Manually reconcile user data between systems using spreadsheets monthly
Use a meta-directory or identity broker to aggregate authoritative data from all HR sources (Correct answer)
Require all subsidiaries to migrate to a single HR system before IAM integration

Correct answer: Use a meta-directory or identity broker to aggregate authoritative data from all HR sources

A meta-directory or identity broker aggregates identity data from multiple authoritative sources, providing a unified view for lifecycle management without requiring HR system consolidation.

Question 71: What is the relationship between theory and practice in Authorization Frameworks?

Theory is unnecessary
Theory provides the foundation; practice applies it to real situations (Correct answer)
Practice is unnecessary if you know theory
They are completely separate

Correct answer: Theory provides the foundation; practice applies it to real situations

Theory provides the conceptual foundation and principles, while practice involves applying those concepts to real-world situations. Both are essential for competence.

Question 72: Which type of social engineering attack specifically targets high-ranking executives to trick them into authorizing large financial transactions or disclosing IAM credentials?

Whaling (Correct answer)
Smishing
Vishing
Pretexting

Correct answer: Whaling

Whaling is a spear-phishing variant that targets executives (C-suite) due to their elevated authority and access.

Question 73: What is the primary risk of failing to deprovision access promptly when an employee resigns?

Compliance with GDPR deletion requests
Increased licensing costs
Slower onboarding for replacements
Orphaned accounts that may be exploited (Correct answer)

Correct answer: Orphaned accounts that may be exploited

Orphaned accounts from departed employees remain active attack surfaces that threat actors can exploit using stolen or guessed credentials.

Question 74: In an identity federation context, which access control mechanism allows an identity provider to communicate a user's group memberships to a service provider?

OAuth scope strings
LDAP directory queries
SAML attribute assertions (Correct answer)
Kerberos tickets

Correct answer: SAML attribute assertions

SAML attribute assertions can carry group membership, roles, and other attributes from the IdP to the SP, enabling the SP to make authorization decisions.

Question 75: What is 'enrollment code' delivery used for in remote identity proofing?

Transmitting a temporary password for first login
Confirming that the applicant has access to a verified address of record (Correct answer)
Generating a cryptographic key for token binding
Encoding identity attributes in a QR code format

Correct answer: Confirming that the applicant has access to a verified address of record

An enrollment code (often delivered via postal mail or SMS to a verified phone number) confirms that the applicant controls the address of record associated with the claimed identity.

Question 76: In a cloud-centric identity architecture, which capability allows lifecycle changes in the identity provider to propagate automatically to downstream SaaS applications?

SAML attribute mapping
SCIM push provisioning (Correct answer)
OAuth token revocation
OpenID Connect session management

Correct answer: SCIM push provisioning

SCIM push provisioning sends real-time lifecycle events (create, update, delete) from the identity provider to SaaS applications, keeping identities synchronized automatically.

Question 77: Which IAM framework focuses on ensuring that users only have access to the resources necessary for their role, minimizing the risk of over-privileged access?

Zero Trust Architecture
Role-Based Access Control (RBAC)
Identity Federation
Principle of Least Privilege (PoLP) (Correct answer)

Correct answer: Principle of Least Privilege (PoLP)

The Principle of Least Privilege (PoLP) is an IAM framework that dictates users, programs, or processes should be granted only the minimum necessary access rights to perform their specific functions. This minimizes the potential damage from a security breach or error, reducing the attack surface.

Question 78: In IAM architecture, what is 'identity proofing' and how does it relate to authentication assurance levels?

Identity proofing only applies to privileged administrative accounts
Identity proofing is performed at every login to re-verify the user's documents
Identity proofing is the same as password reset verification
Identity proofing is the process of verifying claimed identity during enrollment, establishing the foundation for higher assurance authentication (Correct answer)

Correct answer: Identity proofing is the process of verifying claimed identity during enrollment, establishing the foundation for higher assurance authentication

Identity proofing (as defined in NIST SP 800-63A) is the enrollment-time process of verifying that a person is who they claim to be, which sets the maximum achievable authentication assurance level.

Question 79: What is phishing?

A network scanning tool
A backup system
A type of firewall
A social engineering attack using fraudulent communications to steal sensitive data (Correct answer)

Correct answer: A social engineering attack using fraudulent communications to steal sensitive data

Phishing uses deceptive emails, websites, or messages that appear legitimate to trick victims into revealing passwords, credit cards, or personal information.

Question 80: In the context of IAM, what does 'just-in-time (JIT) provisioning' mean?

Granting permanent access rights during onboarding
Deprovisioning accounts immediately upon termination
Provisioning users exactly 24 hours before their start date
Creating user accounts dynamically at the moment of first login (Correct answer)

Correct answer: Creating user accounts dynamically at the moment of first login

JIT provisioning creates or updates a user account automatically when the user first authenticates, often driven by SAML or OIDC assertions.

Question 81: What is multi-factor authentication (MFA)?

Requiring two or more verification methods to confirm identity (Correct answer)
Logging in from multiple devices
Using multiple passwords
Having multiple accounts

Correct answer: Requiring two or more verification methods to confirm identity

MFA combines two or more authentication factors (something you know, have, or are) for stronger identity verification.

Question 82: Which Azure AD feature allows administrators to control which users and groups can access a specific enterprise application?

User assignment required (Correct answer)
Privileged Identity Management
Identity Protection
Conditional Access

Correct answer: User assignment required

Enabling 'User assignment required' on an enterprise application restricts access so only explicitly assigned users or groups can authenticate to that app.

Question 83: A developer is building a mobile app and needs to authenticate users without storing a client secret on the device. Which OAuth 2.0 flow is most appropriate?

Implicit flow
Client Credentials flow
Resource Owner Password Credentials flow
Authorization Code flow with PKCE (Correct answer)

Correct answer: Authorization Code flow with PKCE

Authorization Code with PKCE is designed for public clients (mobile and SPA apps) that cannot securely store a client secret, using a dynamically generated code verifier instead.

Question 84: Which of the following is a key advantage of externalized authorization over embedding authorization logic in application code?

Policies can be updated centrally without redeploying applications (Correct answer)
Application performance improves because fewer database calls are needed
It eliminates the need for access tokens in API calls
It removes the need for authentication before authorization

Correct answer: Policies can be updated centrally without redeploying applications

Externalized authorization decouples policy management from application code, allowing security teams to update, audit, and enforce policies centrally without requiring application changes or redeployments.

Question 85: Which standard defines the protocol for verifying biometric data on a device without sending biometric templates to a remote server?

LDAP v3
RADIUS
OAuth 2.0
FIDO2 / WebAuthn (Correct answer)

Correct answer: FIDO2 / WebAuthn

FIDO2/WebAuthn is designed so biometric data (fingerprint, face) is verified locally on the authenticator device and only a cryptographic proof is sent to the server.

Question 86: Which study approach is most effective for Authorization Frameworks material?

Studying for very long sessions without breaks
Active recall with practice questions (Correct answer)
Passive re-reading of notes
Highlighting all text

Correct answer: Active recall with practice questions

Active recall through practice questions is the most effective study method, as it strengthens memory retrieval pathways.

Question 87: What does 'document authenticity verification' aim to confirm during identity proofing?

That the document's expiration date is in the future
That the document matches the format preferred by the relying party
That the identity document is genuine and has not been tampered with or forged (Correct answer)
That the document has been scanned at sufficient resolution

Correct answer: That the identity document is genuine and has not been tampered with or forged

Document authenticity verification checks security features, holograms, machine-readable zones, and other indicators to confirm a presented document is genuine and unaltered.

Question 88: In the context of IAM frameworks, which term describes the complete set of access rights, permissions, and privileges held by a specific user across all systems?

Access footprint
Identity profile
Entitlement inventory (Correct answer)
Privilege manifest

Correct answer: Entitlement inventory

An entitlement inventory catalogs all access rights assigned to a user across every application, system, and resource in the environment.

Question 89: An organization wants to allow users to log in with their corporate credentials on a third-party SaaS application without sharing passwords. Which federation approach is most appropriate?

Password vaulting
LDAP direct bind
SAML-based SSO (Correct answer)
Basic HTTP authentication

Correct answer: SAML-based SSO

SAML-based SSO enables federated identity so users authenticate at the corporate IdP and the SaaS SP accepts the assertion, never receiving the user's password.

Question 90: Which security concept defines the maximum acceptable downtime for a CIAM authentication service before business operations are critically impacted?

Mean Time to Repair (MTTR)
Recovery Point Objective (RPO)
Service Level Agreement (SLA)
Recovery Time Objective (RTO) (Correct answer)

Correct answer: Recovery Time Objective (RTO)

RTO defines the maximum tolerable length of time a system can be offline before the impact becomes unacceptable to the business.

Question 91: Which of the following is a key factor in ensuring compliance with privacy regulations such as GDPR in IAM?

Enabling SSO for all systems
Encrypting user data during storage and transmission (Correct answer)
Using MFA for all users
Implementing strong password policies

Correct answer: Encrypting user data during storage and transmission

Encrypting user data, both when it is stored (at rest) and when it is being transmitted, is a critical measure for protecting personal information. This practice helps ensure compliance with privacy regulations like GDPR by safeguarding sensitive data from unauthorized access and breaches.

Question 92: What is the purpose of a 'tabletop exercise' in the context of CIAM incident response planning?

To review and update user access permissions
To perform live penetration testing on the CIAM platform
To simulate a security incident scenario and walk through response procedures verbally (Correct answer)
To physically test network failover hardware

Correct answer: To simulate a security incident scenario and walk through response procedures verbally

A tabletop exercise is a discussion-based simulation where participants talk through their response to a hypothetical incident without real-world execution.

Question 93: What is a zero-day vulnerability?

An outdated software version
A low-risk security issue
A security flaw unknown to the vendor with no available patch (Correct answer)
A vulnerability that was fixed immediately

Correct answer: A security flaw unknown to the vendor with no available patch

Zero-day vulnerabilities are newly discovered security flaws that the vendor doesn't know about yet, giving them 'zero days' to fix it before potential exploitation.

Question 94: A SOC 2 Type II audit report for an identity provider is most useful for evaluating which aspect of the IdP?

The IdP's compliance with GDPR data residency requirements
The cryptographic strength of the IdP's signing algorithms
The effectiveness of the IdP's security controls over a period of time (Correct answer)
The IdP's token expiry and refresh policies

Correct answer: The effectiveness of the IdP's security controls over a period of time

A SOC 2 Type II report attests to the design and operating effectiveness of security, availability, and confidentiality controls over a defined review period.

Question 95: Which control specifically prevents a privileged user from reading their own audit logs within a PAM system?

Least privilege
Need-to-know
Dual control
Separation of duties (Correct answer)

Correct answer: Separation of duties

Separation of duties ensures that the person performing privileged actions is different from the person who audits those actions.

Question 96: A company processing EU citizen data from a U.S. data center must rely on which mechanism to legally transfer data under GDPR?

GDPR Article 9 explicit consent only
EU-U.S. Data Privacy Framework (DPF) or Standard Contractual Clauses (SCCs) (Correct answer)
A signed NDA with the data processor
ISO 27001 certification of the U.S. facility

Correct answer: EU-U.S. Data Privacy Framework (DPF) or Standard Contractual Clauses (SCCs)

International data transfers from the EU to the U.S. require a valid transfer mechanism such as the EU-U.S. Data Privacy Framework or Standard Contractual Clauses.

Question 97: When configuring RADIUS for network access authentication, what does the RADIUS server return when authentication succeeds?

A Kerberos ticket
A SAML assertion
A JWT token
An Access-Accept message with optional attributes (Correct answer)

Correct answer: An Access-Accept message with optional attributes

On successful authentication, a RADIUS server responds with an Access-Accept packet, optionally including vendor-specific attributes that grant network access or define access policy.

Question 98: What is a firewall?

A password manager
A security device that monitors and controls network traffic based on rules (Correct answer)
A fire-resistant building component
An antivirus program

Correct answer: A security device that monitors and controls network traffic based on rules

Firewalls filter incoming and outgoing network traffic based on security rules, creating a barrier between trusted and untrusted networks.

Question 99: What is the primary purpose of a PAM (Privileged Access Management) vault?

Issuing SAML assertions to service providers
Securely storing and rotating privileged credentials (Correct answer)
Storing user profile photos securely
Managing OAuth 2.0 client registrations

Correct answer: Securely storing and rotating privileged credentials

A PAM vault stores privileged credentials centrally and can automatically rotate them to reduce the risk of credential theft.

Question 100: What is a zero-day vulnerability?

A vulnerability that was fixed immediately
A low-risk security issue
An outdated software version
A security flaw unknown to the vendor with no available patch (Correct answer)

Correct answer: A security flaw unknown to the vendor with no available patch

Zero-day vulnerabilities are newly discovered security flaws that the vendor doesn't know about yet, giving them 'zero days' to fix it before potential exploitation.

Question 101: Which principle in the FAIR (Factor Analysis of Information Risk) model represents the probable frequency of a threat event occurring?

Vulnerability
Threat event frequency (Correct answer)
Risk
Loss magnitude

Correct answer: Threat event frequency

Threat Event Frequency (TEF) in the FAIR model quantifies how often a threat agent is likely to act against an asset over a given time period.

Question 102: Which approach to role definition starts by analyzing existing user-to-entitlement assignments to discover implicit roles?

Top-down role engineering
Birthright provisioning
Peer group analysis
Bottom-up role mining (Correct answer)

Correct answer: Bottom-up role mining

Bottom-up role mining uses data analytics on existing entitlement assignments to identify common access patterns and suggest role definitions.

CIAM – Certified Identity and Access Manager

The CIAM certification is offered by the Identity Management Institute and validates expertise in identity governance, access management, authentication, risk management, and regulatory compliance. The exam consists of 100 multiple-choice questions to be completed in 90 minutes with a 70% passing score.

100

Questions

90 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

identitymanagementinstitute.org — Renewal, registration deadline, retake fee, retake policy, score release, test dates, time limit, score validity, eligibility, test delivery · verified Oct 2026