Identity Lifecycle Flashcards
7 cards from real CIAM practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Identity Lifecycle flashcards as text
During the joiner process, which attribute is typically used as the authoritative source for creating a new digital identity in an IAM system?
Answer: HR system employee record
The HR system serves as the system of record and authoritative source for new hire data used to create digital identities.
What is the primary risk of failing to deprovision access promptly when an employee resigns?
Answer: Orphaned accounts that may be exploited
Orphaned accounts from departed employees remain active attack surfaces that threat actors can exploit using stolen or guessed credentials.
In identity lifecycle management, what distinguishes a 'mover' event from a 'joiner' event?
Answer: Mover events involve role or department changes for existing employees
A mover event occurs when an existing employee changes roles, departments, or locations, requiring access adjustments rather than new account creation.
Which provisioning model automatically grants access based on a user's role assignment without requiring individual approval?
Answer: Role-based automated provisioning
Role-based automated provisioning assigns entitlements automatically when a role is assigned, reducing manual effort and provisioning delays.
What is 'birthright access' in the context of identity lifecycle management?
Answer: A baseline set of permissions every new joiner receives automatically
Birthright access refers to the minimum set of entitlements provisioned automatically to all new employees regardless of their specific role.
During offboarding, which action should be performed FIRST to minimize risk when an employee is terminated for cause?
Answer: Disabling the account immediately
Immediate account disablement prevents the terminated employee from accessing systems while other offboarding tasks are completed.
What is the purpose of an identity lifecycle policy's 'dormancy' threshold?
Answer: To specify when an inactive account should be flagged or disabled
A dormancy threshold defines the period of inactivity after which an account is automatically flagged, disabled, or reviewed to reduce the attack surface.