Identity and Access Management CISA Practice Questions (Page 5)

Questions 21–23

1. 21application · medium

   A company wants to allow its employees to access a partner's application using their corporate credentials. The partner's application is hosted in a different domain. Which technology should the company use?

   • AFederated identity management
   • BA virtual private network (VPN) to the partner's network
   • CA shared password database between the two companies
   • DSingle sign-on (SSO) within the corporate domain
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company's remote workforce uses laptops with biometric fingerprint readers. The security team wants to add an additional authentication factor for accessing the corporate VPN. Which option would provide a true second factor?

   • ARequire the user to enter a longer password
   • BRequire the user to enter a second fingerprint scan
   • CRequire a one-time passcode generated by an authenticator app on the employee's smartphone
   • DRequire the user to answer a set of personal security questions
   Reveal Solution Discussion Select an answer first
3. 23application · medium

   A company is subject to GDPR and must ensure that personal data is only accessible to employees who need it for their job. The company wants to demonstrate compliance to regulators. Which IAM practice is MOST important?

   • ARegular access reviews to verify that user permissions are appropriate and up to date
   • BUsing biometric authentication for all users
   • CImplementing single sign-on (SSO) for all systems
   • DStoring personal data in an encrypted database
   Reveal Solution Discussion Select an answer first