Identity and Access Management CCOA Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard · select all that apply

   A security analyst is reviewing the IAM controls for a critical application. The analyst wants to ensure that the application enforces accountability. Which of the following controls are essential for accountability? (Select all that apply.)

   • AMulti-factor authentication (MFA) for all users
   • BDetailed audit logs that record who did what and when
   • CUnique user IDs for every user
   • DRole-based access control (RBAC) to limit access
   • ERegular access reviews to ensure appropriate access
   Check answers Discussion Select an answer first
2. 12foundation · easy

   In the context of IAM, which component is responsible for verifying that a user is who they claim to be?

   • AIdentification
   • BAccountability
   • CAuthentication
   • DAuthorization
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A large enterprise is migrating from a legacy system where each department managed its own file shares and permissions. The security team wants to enforce least privilege across the organization. They are considering implementing RBAC. However, a department manager argues that RBAC is too rigid because some employees need temporary access to resources outside their role for specific projects. Which approach should the security team take to address this concern while still maintaining least privilege?

   • AAbandon RBAC and implement discretionary access control (DAC) so department managers can grant access as needed
   • BImplement RBAC with a process for temporary role elevation that requires manager approval and has an expiration time
   • CUse attribute-based access control (ABAC) exclusively, eliminating roles entirely
   • DCreate a single 'superuser' role that includes all permissions and assign it to all employees
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company is considering replacing password-based authentication with a biometric system for all employees. The security team is concerned about the risk of biometric data being stolen and the inability to change biometric traits if compromised. Which additional control should they implement to mitigate these concerns?

   • ARegularly change the biometric template
   • BCombine biometrics with a second factor, such as a smart card or PIN
   • CUse biometrics as the only factor for authentication
   • DStore biometric templates in a centralized database with strong encryption
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company is preparing for a compliance audit. The auditor requires evidence that user access rights are reviewed regularly and that any inappropriate access is corrected. The identity team currently performs access reviews manually using spreadsheets, which is time-consuming and error-prone. The team wants to automate the process but is concerned about the cost of implementing an identity governance tool. Which approach should they take to satisfy the auditor while managing costs?

   • ADisable all user access except for a few administrators to minimize risk
   • BUse a free open-source tool that automatically revokes all access not used in the last 90 days
   • CImplement a basic identity governance tool that automates access certifications and provides audit reports
   • DContinue with manual reviews but increase the frequency to monthly
   Reveal Solution Discussion Select an answer first