A security architect is designing the authorization lifecycle for a new system. The architect must ensure that access rights are reviewed regularly, but also that the review process does not create an excessive administrative burden. Which approach should the architect take?

Conduct manual reviews annually without automation

Automate the review process using a certification tool that sends reminders and tracks approvals

Delegate all reviews to the system administrators

Review access only when a user changes roles

Which technology is used to control access to sensitive documents even after they have been distributed to users?

Digital rights management (DRM)

A government agency is implementing a new system that requires both role-based access for routine tasks and attribute-based access for dynamic, context-sensitive decisions. The architect must design a solution that supports both models without duplicating policy management. Which approach should the architect take?

Use only ABAC and define all permissions as attributes

Implement RBAC for all access and use ABAC only for audit logging

Implement a hybrid model that uses RBAC for baseline permissions and ABAC for dynamic policy decisions

Use only RBAC and add more roles to cover dynamic scenarios

Which authorization approach allows a user to authenticate once and then access multiple applications without re-entering credentials?

Certificate-based authorization

Information Systems Security Architecture Professional

Domain 4Objective 3

4.3 Architect Identity Authorization ISSAP Practice Questions (Page 2)

Part of the Identity and Access Management (IAM) Architecture domain, which accounts for 25% of the ISSAP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–30 in this domain), expect 5–8 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

6concepts

25%of the exam

Questions 6–10

6expert · hard
A security architect is designing the authorization lifecycle for a new system. The architect must ensure that access rights are reviewed regularly, but also that the review process does not create an excessive administrative burden. Which approach should the architect take?
Select an answer first
7application · medium
An employee is leaving the company. The security team needs to ensure that the employee's access to all systems and applications is removed immediately upon termination. Which authorization lifecycle phase should be executed?
Select an answer first
8foundation · easy
Which technology is used to control access to sensitive documents even after they have been distributed to users?
Select an answer first
9expert · hard
A government agency is implementing a new system that requires both role-based access for routine tasks and attribute-based access for dynamic, context-sensitive decisions. The architect must design a solution that supports both models without duplicating policy management. Which approach should the architect take?
Select an answer first
10foundation · easy
Which authorization approach allows a user to authenticate once and then access multiple applications without re-entering credentials?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSAP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSAP” is a trademark of its owner, used for identification only.

4.3 Architect Identity Authorization ISSAP Practice Questions (Page 2)

Questions 6–10

A security architect is designing the authorization lifecycle for a new system. The architect must ensure that access rights are reviewed regularly, but also that the review process does not create an excessive administrative burden. Which approach should the architect take?

An employee is leaving the company. The security team needs to ensure that the employee's access to all systems and applications is removed immediately upon termination. Which authorization lifecycle phase should be executed?

Which technology is used to control access to sensitive documents even after they have been distributed to users?

Which authorization approach allows a user to authenticate once and then access multiple applications without re-entering credentials?

Keep studying — Identity and Access Management (IAM) Architecture