Identity and Access Management CISA Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A multinational corporation has subsidiaries in different countries. Each subsidiary has its own IT team that manages user access to local systems. The corporate security team wants to ensure consistent access control policies across all subsidiaries while respecting local regulatory requirements. Which approach balances these needs?

   • AFully centralize access control administration at the corporate level.
   • BFully decentralize access control administration to each subsidiary.
   • CHave each subsidiary use its own IAM platform and report access rights to corporate quarterly.
   • DUse a centralized IAM platform with local administrators who enforce corporate policies but can adapt to local regulations.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Why is monitoring and recording privileged access sessions important?

   • ATo provide an audit trail and detect unauthorized or malicious activities
   • BTo comply with user privacy regulations
   • CTo improve system performance
   • DTo reduce the need for strong passwords
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A large enterprise has a team of database administrators (DBAs) who need full administrative access to production databases. The security team is concerned about insider threats and wants to ensure that DBA actions are monitored and that the DBA cannot cover their tracks. The company uses a PAM solution that provides session recording and password vaulting. Which additional control is MOST effective in preventing a DBA from hiding malicious activity?

   • ARequire DBAs to use their personal accounts with elevated privileges instead of shared accounts.
   • BUse the PAM solution to rotate the database admin password after each use and require the DBA to use a jump server.
   • CConfigure the PAM solution to record all DBA sessions and store the recordings in a separate, tamper-proof system.
   • DImplement a 'break-glass' process that requires two approvals before a DBA can access a production database.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary purpose of Identity and Access Management (IAM) in an organization?

   • ATo ensure that the right individuals access the right resources at the right times for the right reasons
   • BTo provide a single sign-on experience for all applications
   • CTo encrypt all data at rest and in transit to protect confidentiality
   • DTo monitor network traffic for suspicious activity and prevent intrusions
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company wants to allow employees to access multiple SaaS applications (e.g., Salesforce, Office 365, Workday) with a single corporate login. The company also wants to enforce multi-factor authentication (MFA) for all access to these applications. Which solution should the company implement?

   • ASeparate MFA tokens for each application
   • BA password manager that stores credentials for each application
   • CSingle sign-on (SSO) using a corporate identity provider with MFA integration
   • DFederated identity management with each SaaS provider as an identity provider
   Reveal Solution Discussion Select an answer first