Your organization has a single 'admin' account on all Linux servers used by the IT team. You need to improve accountability without disrupting daily operations. Which approach is most effective?

Issue each admin a personal account with sudo privileges and disable the shared 'admin' account

Keep the shared 'admin' account but require the team to log all commands manually

Grant all users root access directly

Use the same 'admin' account but change the password monthly

A network administrator needs to restrict access to a management VLAN so that only IT staff can SSH to network devices. The company uses Active Directory. What is the most appropriate access control implementation?

Use SNMPv3 with a shared secret for management

Configure the network devices to use RADIUS/TACACS+ authentication against Active Directory and restrict management access to the IT admin group

Allow SSH from any IP but require a strong password

Create local accounts on each device for each IT staff member

What is the primary purpose of the deprovisioning process in identity lifecycle management?

To update user attributes when a user changes departments

To revoke access rights and disable or delete accounts when they are no longer needed

To authenticate users during the login process

To assign new roles to users based on job changes

An employee is moving from the Finance department to the Marketing department. The company uses RBAC with department-specific roles. What is the correct identity lifecycle action?

Delete the user account and recreate it with Marketing roles

Keep the Finance roles and add the Marketing roles

Assign the Marketing roles and leave the Finance roles for a transition period

Remove the Finance roles and assign the Marketing roles, then review for any conflicting permissions

A healthcare organization needs to control access to patient records. The access policy requires that only doctors and nurses assigned to a patient's care team can view the patient's record, and that access is automatically denied if the care team relationship ends. The organization also needs to support emergency access when a doctor is not assigned to the patient but needs immediate access. Which authorization model best supports these dynamic and emergency access requirements?

Role-based access control (RBAC), because it assigns permissions to roles and can be updated when roles change.

Mandatory access control (MAC), because it enforces access based on security labels.

Attribute-based access control (ABAC), because it can evaluate attributes such as care team membership and can support emergency access through dynamic policy rules.

Discretionary access control (DAC), because the patient record owner can grant access to specific users.

GIAC Information Security Professional

Domain 3Objective 1

Identity and Access Management (IAM) GISP Practice Questions (Page 1)

Part of the Access, Testing, and Development domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~29–50 in this domain), expect 10–17 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

8concepts

Questions 1–5

1application · medium
Your organization has a single 'admin' account on all Linux servers used by the IT team. You need to improve accountability without disrupting daily operations. Which approach is most effective?
Select an answer first
2application · medium
A network administrator needs to restrict access to a management VLAN so that only IT staff can SSH to network devices. The company uses Active Directory. What is the most appropriate access control implementation?
Select an answer first
3foundation · easy
What is the primary purpose of the deprovisioning process in identity lifecycle management?
Select an answer first
4application · medium
An employee is moving from the Finance department to the Marketing department. The company uses RBAC with department-specific roles. What is the correct identity lifecycle action?
Select an answer first
5expert · hard
A healthcare organization needs to control access to patient records. The access policy requires that only doctors and nurses assigned to a patient's care team can view the patient's record, and that access is automatically denied if the care team relationship ends. The organization also needs to support emergency access when a doctor is not assigned to the patient but needs immediate access. Which authorization model best supports these dynamic and emergency access requirements?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISP” is a trademark of its owner, used for identification only.