A multinational company has a policy that all user accounts must be disabled within 24 hours of an employee's termination. However, the company also has a legal requirement to preserve the employee's email and documents for potential litigation. The HR system automatically triggers the deprovisioning process. Which deprovisioning workflow best satisfies both the security policy and the legal hold requirement?

Keep the account active for 30 days to allow for a transition, then disable it and preserve the data.

Automatically delete the account and all associated data immediately to ensure no access remains.

Disable the account but do not revoke active sessions, and preserve the data only if the legal team requests it.

Automatically disable the account and revoke all sessions, then place a legal hold on the mailbox and OneDrive/SharePoint data, preserving it for the required period.

In which authorization model does the data owner or resource owner have the discretion to grant or revoke access to their resources?

Attribute-Based Access Control (ABAC)

Role-Based Access Control (RBAC)

Discretionary Access Control (DAC)

A contractor is leaving your company. Their user account is tied to a shared project folder that other active employees still need. According to identity lifecycle best practices, what should you do FIRST?

Delete the contractor's account immediately and create a new shared account for the project team

Change the contractor's password and keep the account active for the remaining employees

Leave the account active until the project is completed, then delete it

Disable the contractor's account, transfer ownership of the shared folder to an active employee, then remove the contractor's access

Your organization is implementing SSO for a legacy application that does not support modern protocols. The application supports only LDAP authentication. You need to provide SSO without changing the application. What is the most viable approach?

Use an identity bridge that translates SAML/OIDC assertions into LDAP authentication for the legacy application

Force users to maintain separate credentials for the legacy application

Replace the legacy application with a modern one that supports SAML

Use a password manager to auto-fill the legacy application's login

GIAC Information Security Professional

Domain 3Objective 1

Identity and Access Management (IAM) GISP Practice Questions (Page 3)

Part of the Access, Testing, and Development domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~29–50 in this domain), expect 10–17 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

8concepts

Questions 11–15

11expert · hard
A multinational company has a policy that all user accounts must be disabled within 24 hours of an employee's termination. However, the company also has a legal requirement to preserve the employee's email and documents for potential litigation. The HR system automatically triggers the deprovisioning process. Which deprovisioning workflow best satisfies both the security policy and the legal hold requirement?
Select an answer first
12foundation · easy
In the context of identity and access management (IAM), which term refers to the process of verifying that a claimed identity is valid?
Select an answer first
13foundation · easy
In which authorization model does the data owner or resource owner have the discretion to grant or revoke access to their resources?
Select an answer first
14application · medium
A contractor is leaving your company. Their user account is tied to a shared project folder that other active employees still need. According to identity lifecycle best practices, what should you do FIRST?
Select an answer first
15expert · hard
Your organization is implementing SSO for a legacy application that does not support modern protocols. The application supports only LDAP authentication. You need to provide SSO without changing the application. What is the most viable approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GISP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISP” is a trademark of its owner, used for identification only.

Identity and Access Management (IAM) GISP Practice Questions (Page 3)

Questions 11–15

In the context of identity and access management (IAM), which term refers to the process of verifying that a claimed identity is valid?

In which authorization model does the data owner or resource owner have the discretion to grant or revoke access to their resources?

A contractor is leaving your company. Their user account is tied to a shared project folder that other active employees still need. According to identity lifecycle best practices, what should you do FIRST?

Your organization is implementing SSO for a legacy application that does not support modern protocols. The application supports only LDAP authentication. You need to provide SSO without changing the application. What is the most viable approach?

Keep studying — Access, Testing, and Development