Identity and Access Management CISA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A small business is implementing an IAM program for the first time. The owner wants to ensure that only authorized employees can access the company's accounting software and that access is removed when an employee leaves. Which IAM component is MOST critical to implement first?

   • APrivileged access management (PAM) for administrators
   • BSingle sign-on (SSO) for all applications
   • CIdentity lifecycle management, including provisioning and deprovisioning
   • DMulti-factor authentication (MFA) for all users
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A university allows students to access the library portal, email, and learning management system (LMS) using their university credentials. The university now wants to allow students to use their Google accounts to access the LMS without creating a separate account. Which technology should the university implement?

   • AA new local account for each student with a password synced to Google
   • BMulti-factor authentication (MFA) for the LMS
   • CFederated identity management with Google as the identity provider
   • DSingle sign-on (SSO) within the university's own identity provider
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   How does IAM governance help an organization meet regulatory requirements?

   • ABy providing documented processes for access reviews, approvals, and audit trails
   • BBy automatically deleting all user data after a certain period
   • CBy encrypting all data in the organization
   • DBy preventing all security incidents
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A publicly traded company must comply with SOX, which requires segregation of duties (SoD) for financial processes. The company uses an ERP system with role-based access control. An internal audit reveals that a single user has both 'Create Purchase Order' and 'Approve Purchase Order' roles. The company wants to remediate this without disrupting business operations. Which action is the BEST first step?

   • AImmediately remove the conflicting role from the user's account.
   • BDisable the user's account until the conflict is resolved.
   • CAnalyze the user's job function and determine if the conflicting roles are actually necessary for their role.
   • DImplement a compensating control, such as requiring a manager to review all purchase orders created by that user.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A company has a high turnover rate in its sales department. The identity management team is struggling to keep up with creating and disabling accounts. An auditor notes that some former employees still have active accounts. The company wants to reduce the risk of orphaned accounts while minimizing the burden on the IT team. Which approach is MOST effective?

   • ADeactivate accounts after 90 days of inactivity.
   • BConduct a monthly audit of active accounts against the HR system.
   • CRequire managers to submit a ticket for every new hire and termination.
   • DAutomate the identity lifecycle by integrating HR systems with the IAM platform to provision and deprovision accounts based on employee status.
   Reveal Solution Discussion Select an answer first