Which access control technology is specifically designed to manage and safeguard accounts with elevated privileges?

Privileged Access Management (PAM)

Multi-Factor Authentication (MFA)

A university allows students and faculty to use their existing Google accounts to access the university's learning management system (LMS). The LMS does not store passwords; it trusts the authentication performed by Google. Which access control technology is being used?

Single sign-on (SSO) within the university's own identity provider

Privileged access management (PAM) for administrative accounts

Multi-factor authentication (MFA) enforced by the LMS

Federation using Security Assertion Markup Language (SAML) or OpenID Connect (OIDC)

Which authentication method is considered the most resistant to phishing attacks because it does not rely on a shared secret that can be intercepted?

SMS-based one-time passwords (OTP)

Knowledge-based authentication (security questions)

Certificate-based authentication

A healthcare organization is subject to HIPAA and must ensure that only authorized personnel can access protected health information (PHI). The organization wants to implement a mechanism to track who accessed what PHI and when, to support auditing and accountability. Which IAM component is most directly required?

Identification through unique user IDs

Authentication via strong passwords

Accountability through detailed audit logging

Authorization based on role-based access control (RBAC)

In Role-Based Access Control (RBAC), what is the primary basis for granting access permissions?

The user's location and time of access

The user's job function or role within the organization

The user's individual identity and personal preferences

The sensitivity level of the data and the user's clearance

Certified Cybersecurity Operations Analyst

Domain 5Objective 3

Identity and Access Management CCOA Practice Questions (Page 2)

Part of the Domain 5: Securing Assets domain, which accounts for 11% of the CCOA exam. ISACA does not publish an official question count, but from its 240-minute exam (~95–160 total, ~10–18 in this domain), expect 1–2 from this objective — we provide 19 practice questions to prepare you well beyond it. (estimate)

19questions here

4free pages

6concepts

11%of the exam

Questions 6–10

6foundation · easy
Which access control technology is specifically designed to manage and safeguard accounts with elevated privileges?
Select an answer first
7application · medium
A university allows students and faculty to use their existing Google accounts to access the university's learning management system (LMS). The LMS does not store passwords; it trusts the authentication performed by Google. Which access control technology is being used?
Select an answer first
8foundation · easy
Which authentication method is considered the most resistant to phishing attacks because it does not rely on a shared secret that can be intercepted?
Select an answer first
9application · medium
A healthcare organization is subject to HIPAA and must ensure that only authorized personnel can access protected health information (PHI). The organization wants to implement a mechanism to track who accessed what PHI and when, to support auditing and accountability. Which IAM component is most directly required?
Select an answer first
10foundation · easy
In Role-Based Access Control (RBAC), what is the primary basis for granting access permissions?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCOA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CCOA” is a trademark of its owner, used for identification only.