A company wants to allow its employees to access a partner's application using their corporate credentials. The partner requires that the company attest that each user is still employed. Which IAM capability is REQUIRED to meet this requirement?

Federation with just-in-time (JIT) provisioning and account deprovisioning

A shared password vault for all employees

Biometric authentication on the partner's app

A static list of employees emailed monthly

An auditor requires evidence that all access to a critical system is reviewed periodically. The system logs every login and file access. Which practice would BEST satisfy the auditor's requirement?

Generate a monthly report of all access events and have the system owner review and sign it

Only review logs when an incident occurs

Store logs for one year without review

Automatically delete logs after 30 days

A company is implementing single sign-on (SSO) for its employees across multiple cloud applications. The company uses an identity provider (IdP) that supports both SAML and OIDC. The security team wants to ensure that authentication is phishing-resistant and that the SSO solution supports both web and mobile applications. Which approach should be taken?

Use SAML for mobile applications and OIDC for web applications, with hardware tokens

Use OIDC for all applications and require password-only authentication

Use SAML for web applications and OIDC for mobile applications, with FIDO2 WebAuthn as the primary authentication method

Use SAML for all applications and require SMS-based MFA

An organization is preparing for a compliance audit. The auditor requires evidence that user access rights are reviewed periodically and that excessive permissions are removed. The IAM team currently performs access reviews manually once a year. The auditor has flagged that the review process is insufficient because it does not include a mechanism to verify that users still need their current access. Which improvement should the IAM team implement?

Require users to request access annually through a self-service portal

Automate the removal of all access rights that have not been used in 90 days

Increase the frequency of access reviews to quarterly and require managers to certify each user's access

Implement single sign-on (SSO) to reduce the number of accounts

GIAC Critical Controls Certification

Domain 3Objective 1

Access Control Management GCCC Practice Questions (Page 4)

Part of the Access and Identity Management domain, which makes up ~11% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 3–5 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

8concepts

Questions 16–20

16expert · hard
A company wants to allow its employees to access a partner's application using their corporate credentials. The partner requires that the company attest that each user is still employed. Which IAM capability is REQUIRED to meet this requirement?
Select an answer first
17foundation · easy
Which authentication method uses unique physical or behavioral characteristics of a person, such as fingerprints or voice patterns?
Select an answer first
18expert · hard
An auditor requires evidence that all access to a critical system is reviewed periodically. The system logs every login and file access. Which practice would BEST satisfy the auditor's requirement?
Select an answer first
19expert · hard
A company is implementing single sign-on (SSO) for its employees across multiple cloud applications. The company uses an identity provider (IdP) that supports both SAML and OIDC. The security team wants to ensure that authentication is phishing-resistant and that the SSO solution supports both web and mobile applications. Which approach should be taken?
Select an answer first
20expert · hard
An organization is preparing for a compliance audit. The auditor requires evidence that user access rights are reviewed periodically and that excessive permissions are removed. The IAM team currently performs access reviews manually once a year. The auditor has flagged that the review process is insufficient because it does not include a mechanism to verify that users still need their current access. Which improvement should the IAM team implement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCCC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCCC” is a trademark of its owner, used for identification only.

Access Control Management GCCC Practice Questions (Page 4)

Questions 16–20

A company wants to allow its employees to access a partner's application using their corporate credentials. The partner requires that the company attest that each user is still employed. Which IAM capability is REQUIRED to meet this requirement?

Which authentication method uses unique physical or behavioral characteristics of a person, such as fingerprints or voice patterns?

An auditor requires evidence that all access to a critical system is reviewed periodically. The system logs every login and file access. Which practice would BEST satisfy the auditor's requirement?

Keep studying — Access and Identity Management