Customer Identity and Access Management GCAD Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A CIAM team is investigating a series of account takeovers. The attacks all originate from residential IP addresses, use valid credentials, and pass MFA. The only common factor is that the victims recently used a third-party 'coupon finder' browser extension. Which attack vector is most likely, and which control is most effective?

   • ASIM-swapping to intercept SMS OTP; control: move to TOTP
   • BCredential stuffing from breached databases; control: enforce breached-password screening
   • CPhishing via fake coupon sites; control: enforce phishing-resistant MFA (FIDO2)
   • DSession hijacking via a malicious browser extension that steals session cookies; control: implement device binding and anomaly detection on session tokens
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company is migrating from a workforce IAM system to a CIAM platform for their customer portal. The workforce IAM uses Active Directory with group-based access. The CIAM must support millions of external users who self-register. Which architectural change is most critical?

   • AKeep using Active Directory as the identity store for customers
   • BDisable all access control and rely on the application to enforce permissions
   • CUse the same group-based access model but create groups for each customer segment
   • DReplace group-based access with attribute-based access control (ABAC) using customer attributes and consent
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A startup is building a customer-facing application and needs to manage user registration, login, and consent. They have no existing identity infrastructure. The CTO wants to minimize development effort and time-to-market. Which approach is most aligned with the CIAM fundamentals?

   • AUse a simple OAuth2 server and implement all other features in the application
   • BUse a cloud-based CIAM platform (e.g., Auth0, Okta CIC) that provides pre-built login, registration, consent, and self-service flows
   • CUse a workforce IAM product and expose it to customers
   • DBuild a custom authentication service from scratch using a database of usernames and passwords
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A customer requests deletion of their account and all associated data. The company must comply with GDPR. However, the customer has an outstanding invoice that is disputed. The finance department requires the customer's billing information to resolve the dispute. The CIAM team must balance the erasure request with the legal obligation to retain financial records. What is the correct approach?

   • ADelete the account and all personal data except the billing information required to resolve the disputed invoice, and restrict processing of that data to the dispute resolution only
   • BRefuse the erasure request entirely because of the disputed invoice
   • CDelete the customer's account and all personal data immediately, including billing information
   • DAnonymize the billing information so it cannot be linked to the customer, and delete the rest
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which of the following is an example of a passwordless authentication method for customers?

   • ABiometric authentication using a fingerprint scanner
   • BUsername and password
   • COne-time passcode sent via SMS
   • DSecurity questions
   Reveal Solution Discussion Select an answer first