CIAM Governance and Compliance 1 — Questions and Answers
Question 1: Which of the following best describes the purpose of auditing in an IAM system?
- To assign users to appropriate roles based on their job functions
- To monitor and review user activity and access to ensure compliance with policies (Correct answer)
- To establish new access control policies
- To create new user accounts for employees
Correct answer: To monitor and review user activity and access to ensure compliance with policies
Auditing in IAM systems involves reviewing user activities, access permissions, and any anomalies to ensure compliance with internal policies and regulatory requirements. This helps in identifying security breaches or non-compliance issues.
Question 2: What is a key requirement for IAM systems to comply with data privacy regulations like GDPR?
- Encryption of data during transmission (Correct answer)
- Limiting access based on user roles only
- Regular password changes for all users
- Storing all user data in the cloud
Correct answer: Encryption of data during transmission
Data privacy regulations like GDPR require that personal data be protected. One of the ways to ensure this protection is through encryption, which safeguards sensitive data during transmission and storage, preventing unauthorized access.
Question 3: Which IAM principle restricts users to only the resources and permissions needed for their job role?
- Role-Based Access Control (RBAC)
- Principle of Least Privilege (PoLP) (Correct answer)
- Identity Federation
- Access Control Lists (ACLs)
Correct answer: Principle of Least Privilege (PoLP)
The Principle of Least Privilege (PoLP) dictates that users should only have access to the resources and permissions necessary for their job. This minimizes the potential impact of security breaches and reduces the attack surface.
Question 4: In compliance with the Sarbanes-Oxley Act (SOX), what must organizations regularly audit?
- Password strength
- User access and privileges (Correct answer)
- Data storage locations
- Employee performance reviews
Correct answer: User access and privileges
Sarbanes-Oxley (SOX) mandates regular audits of user access and privileges, especially in financial systems, to ensure that only authorized individuals have access to sensitive financial data. This helps ensure accountability and prevent fraud.
Question 5: What is the primary function of an Access Control Policy in IAM governance?
- To create detailed user reports
- To define and enforce rules for user authentication and access to resources (Correct answer)
- To store backup copies of user data
- To provide employees with access to training resources
Correct answer: To define and enforce rules for user authentication and access to resources
An Access Control Policy defines the rules governing how users authenticate and what resources they can access within an organization. It ensures that only authorized users are granted access to specific systems or data, in accordance with governance and compliance requirements.
CIAM Governance and Compliance 1
Which of the following best describes the purpose of auditing in an IAM system?