GRC Tools CAS-005 Practice Questions (Page 7)

Questions 31–32

1. 31application · medium

   A retail company wants to integrate its GRC tool with its existing identity management system to automate user access reviews and certification campaigns. The goal is to reduce manual effort and ensure timely identification of excessive permissions. Which integration approach best achieves this?

   • AExport user access data from the identity management system and import it into the GRC tool on a monthly basis.
   • BHave the GRC tool directly query the identity management system's database every time a review is needed.
   • CUse application programming interfaces (APIs) to synchronize user access data between the identity management system and the GRC tool in real time.
   • DAsk managers to manually review access lists provided by the identity management system and report findings to the compliance team.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is a common method for collecting data to verify compliance with access control policies?

   • AConducting a penetration test of the network perimeter
   • BInterviewing employees about their job satisfaction
   • CReviewing user access logs and permission reports
   • DPerforming a physical security inspection of the data center
   Reveal Solution Discussion Select an answer first