Customer Identity and Access Management GCAD Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A company is evaluating whether to build a custom CIAM solution or buy a commercial CIAM platform. The company has a small development team and needs to launch a customer portal in three months. The portal will support social login and self-service password reset. Which approach is most appropriate?

   • AUse the company's existing workforce IAM system for customer login.
   • BDelay the portal launch by one year to build a fully custom CIAM system.
   • CBuild a custom CIAM solution from scratch to have full control over the code.
   • DPurchase a commercial CIAM platform that provides social login and self-service password reset out of the box.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which self-service capability is most likely to improve customer experience while maintaining security?

   • AAllowing customers to change their account type without verification
   • BAllowing customers to view other customers' profiles
   • CAllowing customers to update their profile information
   • DAllowing customers to disable MFA on their account
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   Which of the following is an effective mitigation against account takeover in a CIAM system?

   • AStoring passwords in plaintext
   • BRequiring multi-factor authentication (MFA) for all customers
   • CDisabling password complexity requirements
   • DAllowing unlimited login attempts
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A CIAM team wants to use analytics to detect account takeover (ATO) in real time. They have access to login event streams (IP, device, time), transaction data (amount, type), and customer profile data (age, location). Which analytics approach is most effective for detecting ATO while minimizing false positives that would harm legitimate customers?

   • ABlock any login from a new device or IP address
   • BOnly analyze failed login attempts to detect brute-force attacks
   • CFlag all logins that occur outside the customer's home country
   • DBuild a machine learning model that scores each login based on deviation from the customer's historical behavior (device, IP, location, time) and transaction patterns, and trigger step-up authentication only for high-risk scores
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A customer calls support because they are locked out of their account after multiple failed login attempts. The account has MFA enabled. The support agent needs to verify the customer's identity to unlock the account. The company wants to minimize the risk of social engineering while providing a good customer experience. Which verification method is most appropriate?

   • AAsk the customer for their password and the OTP from their authenticator app
   • BSend a one-time unlock code to the customer's verified email address and require them to provide it to the agent
   • CUse a verified identity proofing flow (e.g., sending a code to the registered phone and asking for a recent transaction or account detail) and then issue a temporary unlock link that expires in 10 minutes
   • DImmediately unlock the account after the customer provides their name and email address
   Reveal Solution Discussion Select an answer first