A company wants to allow employees to use their existing corporate credentials to access a third-party SaaS application without creating a separate account. Which IAM approach should they implement?

Biometric authentication on the SaaS app

A shared generic account for all employees

Local account provisioning with the same password

Federated single sign-on (SSO) using SAML or OIDC

A contractor's engagement ends today. The IAM team must ensure that the contractor's access to all systems is revoked promptly. Which process should be followed?

Notify the contractor to return any company devices but leave accounts active

Change the contractor's password and keep the account active for a week

Disable the contractor's accounts and remove them from all access groups

Delete the contractor's accounts at the end of the next billing cycle

What is identity federation in the context of IAM?

The process of combining multiple user accounts into one

The use of biometric data for authentication

The establishment of trust relationships between organizations to share identity information

The process of deprovisioning user accounts

A security analyst notices that a terminated employee's account was used to log in to the VPN three days after the termination date. Which control would have MOST likely prevented this?

Automated deprovisioning of the account upon termination

Requiring multi-factor authentication for VPN

A large organization is reviewing its access control policies. The security team finds that many users have accumulated excessive permissions over time due to role changes and internal transfers. The team wants to implement a process to reduce these permissions while minimizing disruption to business operations. Which approach should be taken?

Conduct a comprehensive access review and remove permissions that are not explicitly required for each user's current role

Implement a new role-based access control (RBAC) model and assign users to roles based on their previous permissions

Immediately revoke all permissions and re-grant them only upon user request

Increase the frequency of password changes to reduce the risk of unauthorized access

GIAC Critical Controls Certification

Domain 3Objective 1

Access Control Management GCCC Practice Questions (Page 3)

Part of the Access and Identity Management domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 3–5 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

8concepts

Questions 11–15

11application · medium
A company wants to allow employees to use their existing corporate credentials to access a third-party SaaS application without creating a separate account. Which IAM approach should they implement?
Select an answer first
12application · medium
A contractor's engagement ends today. The IAM team must ensure that the contractor's access to all systems is revoked promptly. Which process should be followed?
Select an answer first
13foundation · easy
What is identity federation in the context of IAM?
Select an answer first
14application · medium
A security analyst notices that a terminated employee's account was used to log in to the VPN three days after the termination date. Which control would have MOST likely prevented this?
Select an answer first
15expert · hard
A large organization is reviewing its access control policies. The security team finds that many users have accumulated excessive permissions over time due to role changes and internal transfers. The team wants to implement a process to reduce these permissions while minimizing disruption to business operations. Which approach should be taken?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.