Learn About the Processes and Controls Involved in Identity Management, Authentication, and Access Control. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the primary purpose of identity management in an organization?

   • ATo create and maintain digital identities for users, devices, and services, and manage their attributes throughout their lifecycle.
   • BTo encrypt all data stored in the organization's databases and file shares.
   • CTo monitor network traffic for suspicious activity and block malicious connections.
   • DTo define the rules for how users interact with each other in a collaborative environment.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the primary goal of privileged access management (PAM)?

   • ATo protect and monitor accounts with elevated permissions to reduce the risk of misuse.
   • BTo eliminate the need for passwords by using biometric authentication for all users.
   • CTo provide all users with the same level of access to simplify administration.
   • DTo ensure that all user accounts are disabled by default and enabled only upon request.
   Reveal Solution Discussion Select an answer first
4. 3expert · medium

   A company has a high turnover rate and wants to ensure that former employees' access is revoked promptly. Which control is most effective?

   • AQuarterly access reviews to identify and remove former employees
   • BAutomated deprovisioning integrated with HR systems
   • CRelying on the employee to return their badge and credentials
   • DManual deprovisioning by IT when notified
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which phase of the identity lifecycle involves creating a digital identity for a new employee and granting initial access rights?

   • AProvisioning
   • BAuthorization
   • CAuthentication
   • DDeprovisioning
   Reveal Solution Discussion Select an answer first
6. 5expert · medium

   A company has a policy that all user accounts must be reviewed every 90 days. However, the IT team is struggling to keep up with the volume of accounts. What is the most effective way to ensure compliance?

   • AAsk managers to self-report their team's access
   • BReview only a sample of accounts each quarter
   • CExtend the review cycle to 180 days to reduce workload
   • DAutomate the access review process with a tool that flags inactive or excessive permissions
   Reveal Solution Discussion Select an answer first