A multinational company operates a customer portal in both the EU and the US. The company wants to use customer behavioral data for marketing analytics. The legal team has determined that EU customers must provide explicit opt-in consent, while US customers can be opted out by default. The company wants to implement a single consent management system. What is the most appropriate design?

Apply the US opt-out standard to all customers to maximize marketing data.

Use geolocation to determine the customer's region and present the appropriate consent flow.

Apply the EU opt-in standard to all customers globally for consistency.

Ask every customer to choose their preferred consent standard at registration.

What is the purpose of the deprovisioning stage in customer identity lifecycle management?

To verify the customer's identity during registration

To provide the customer with a new password

To remove or deactivate a customer's account and associated access when it is no longer needed

To update the customer's profile with new contact information

A SaaS company wants to reduce customer churn by identifying users who are likely to abandon the product. The company has access to CIAM analytics data, including login frequency, feature usage, and session duration. Which analysis would be most useful for this goal?

Count the total number of registered users per month.

Correlate a decline in login frequency and session duration with subsequent account cancellation or prolonged inactivity.

Measure the average time between password resets.

Track the number of support tickets per user.

What is the purpose of an access control policy in a customer-facing application?

To track customer login history

To define which resources a customer can access and what actions they can perform

To store customer passwords securely

GIAC Cloud Security Architecture and Design

Domain 1Objective 2

Customer Identity and Access Management GCAD Practice Questions (Page 2)

Part of the Identity and Access Management domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–23 in this domain), expect 3–5 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

10concepts

Questions 6–10

6expert · hard
A multinational company operates a customer portal in both the EU and the US. The company wants to use customer behavioral data for marketing analytics. The legal team has determined that EU customers must provide explicit opt-in consent, while US customers can be opted out by default. The company wants to implement a single consent management system. What is the most appropriate design?
Select an answer first
7foundation · easy
What is the purpose of the deprovisioning stage in customer identity lifecycle management?
Select an answer first
8foundation · easy
Which protocol is commonly used for integrating CIAM with customer-facing applications for authentication?
Select an answer first
9application · medium
A SaaS company wants to reduce customer churn by identifying users who are likely to abandon the product. The company has access to CIAM analytics data, including login frequency, feature usage, and session duration. Which analysis would be most useful for this goal?
Select an answer first
10foundation · easy
What is the purpose of an access control policy in a customer-facing application?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCAD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCAD” is a trademark of its owner, used for identification only.

Customer Identity and Access Management GCAD Practice Questions (Page 2)

Questions 6–10

What is the purpose of the deprovisioning stage in customer identity lifecycle management?

Which protocol is commonly used for integrating CIAM with customer-facing applications for authentication?

A SaaS company wants to reduce customer churn by identifying users who are likely to abandon the product. The company has access to CIAM analytics data, including login frequency, feature usage, and session duration. Which analysis would be most useful for this goal?

What is the purpose of an access control policy in a customer-facing application?

Keep studying — Identity and Access Management