A few months into studying for the CIAM exam and the identity governance and administration section is giving me the most trouble. I work in IAM engineering so the technical implementation side feels fine, but the governance frameworks and policy-level content is harder to retain. Been averaging 90 minutes a day for 10 weeks and practice scores are sitting at 74-76%.
The access certification and role lifecycle management questions are where I keep losing points. I understand the concepts but scenario questions seem to want a specific sequence and I keep picking the almost-right answer. Not sure if that's a study material issue or just needing more reps on that question format.
For anyone who prepped for CIAM recently — how much does the exam lean on practical troubleshooting versus governance framework knowledge? Trying to decide whether my last 3 weeks should be scenario drilling or going back through the conceptual foundation first.
Also wondering how the multi-cloud federation governance questions are weighted. SAML, OIDC, and OAuth 2.0 I know well technically — it's the policy and audit trail questions around multi-cloud federation that feel like a different beast from what I do day-to-day.
The almost-right problem is very common on this exam. The distractors are procedurally correct in isolation but wrong in sequence or context. Slow down on those questions and ask what step comes before and after — the sequence usually tells you which answer is right.
Federation protocols were on there — more SAML and OIDC than pure OAuth in my experience. But the multi-cloud governance questions are more policy than protocol. Who owns the federation trust decisions, what does the audit trail look like, and what's the escalation path when trust breaks.
For your last 3 weeks, do scenario drilling over conceptual review. At 74-76% you're not missing concepts, you're missing the exam's preferred answer logic. That only gets fixed through reps, not re-reading framework material you've already covered.
Passed with 81% and identity governance was probably 30% of the exam. The access certification campaign questions were scenario-heavy — a lot of what-should-the-reviewer-do situations testing judgment about escalation and exception handling, not just procedural steps.