4.1 Architect Identity Lifecycle ISSAP Practice Questions (Page 5)

Questions 21–24

1. 21expert · hard

   A security architect is designing a de-provisioning process for a high-security environment. The requirement is that when an employee is terminated, their access must be revoked immediately, but their identity data must be retained for audit purposes for seven years. Which of the following approaches BEST meets this requirement?

   • ARemove the account from the directory but keep a log of the deletion.
   • BChange the account's password and leave it active for a week.
   • CDelete the account immediately and rely on backup tapes for audit data.
   • DDisable the account and move it to an archived state that preserves all attributes.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A contractor's contract is ending in two weeks. The security architect needs to ensure that the contractor's access is revoked promptly. Which of the following is the BEST approach to de-provisioning the contractor's identity?

   • AKeep the account active until the contractor requests removal.
   • BDelete the account immediately on the contract end date.
   • CChange the contractor's password and inform them of the change.
   • DDisable the account on the contract end date and delete it after a defined retention period.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A remote employee is being onboarded and cannot present physical documents in person. The security architect must verify the employee's identity. Which of the following methods is MOST appropriate for remote identity verification?

   • AUse a video call to visually compare the employee to their photo ID.
   • BAccept a scanned copy of the employee's passport sent via email.
   • CRely on the employee's self-declaration of identity.
   • DAsk the employee to provide their social media profile as proof.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   An organization is migrating from an on-premises identity management system to a cloud-based identity provider. The security architect must ensure that the migration does not disrupt access for users. Which of the following strategies is MOST appropriate to minimize disruption?

   • AKeep the on-premises system as the primary and use the cloud system only for new users.
   • BMigrate users in phases by department, but do not synchronize identities between systems.
   • CRun both systems in parallel and synchronize identities until the cloud system is stable.
   • DPerform a big-bang migration over a weekend and decommission the on-premises system immediately.
   Reveal Solution Discussion Select an answer first