I85PREP
⌘ K
IM-CCM study materials
IM-CCM study resources

IM-CCM practice questions

One question at a time. Build your IM-CCM understanding.

First 50 of 199 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Identify and Access Management Fundamentals

Which principle states that a user should be granted only the permissions required to perform their job and nothing more?

  1. Defense in depth
  2. Mandatory access control
  3. Least privilege Correct answer.
  4. Separation of duties

Explanation

Least privilege limits access rights to the minimum necessary for a task. Separation of duties divides tasks among people, defense in depth layers controls, and mandatory access control is a policy model rather than a grant-limiting principle.

Question 2Identify and Access Management Fundamentals

In the identity lifecycle, which activity immediately follows the provisioning of a new user account?

  1. Password reset
  2. Role assignment and entitlement granting Correct answer.
  3. Access review
  4. Deprovisioning

Explanation

Provisioning creates the account, and the next step is assigning roles and entitlements so the identity can do its job. Deprovisioning occurs at the end of the lifecycle, and access reviews are periodic governance activities.

Question 3Identify and Access Management Fundamentals

Which authentication factor category is a hardware token that generates a one-time code?

  1. Something you know
  2. Something you are
  3. Something you have Correct answer.
  4. Somewhere you are

Explanation

A hardware token is a physical object the user possesses, so it belongs to the 'something you have' factor category. Knowledge factors are memorized secrets, inherence factors are biometrics, and location is a contextual attribute.

Question 4Identify and Access Management Fundamentals

What is the primary purpose of single sign-on (SSO)?

  1. To encrypt all traffic between users and applications
  2. To replace authorization with authentication
  3. To allow one set of credentials to access multiple applications Correct answer.
  4. To eliminate the need for any authentication

Explanation

SSO lets a user authenticate once and access multiple federated applications without re-entering credentials. It does not remove authentication, encrypt traffic, or substitute for authorization decisions.

Question 5Identify and Access Management Fundamentals

Which access control model bases decisions on the user's assigned job function rather than on the owner's discretion?

  1. Role-based access control (RBAC) Correct answer.
  2. Rule-based access control
  3. Attribute-based access control (ABAC)
  4. Discretionary access control (DAC)

Explanation

RBAC grants permissions to roles and assigns users to roles, tying access to job function. DAC lets resource owners set permissions, rule-based control uses system rules, and ABAC evaluates attributes rather than roles.

Question 6Identify and Access Management Fundamentals

What does the principle of separation of duties primarily mitigate?

  1. Fraud or error by a single individual acting alone Correct answer.
  2. Network eavesdropping
  3. Weak password complexity
  4. Denial-of-service attacks

Explanation

Separation of duties splits a sensitive process so that no single person can complete it alone, reducing the risk of fraud or undetected error. It does not address password strength, network interception, or availability attacks.

Question 7Identify and Access Management Fundamentals

Which term describes the process of verifying that a claimed identity is genuine?

  1. Auditing
  2. Authentication Correct answer.
  3. Accounting
  4. Authorization

Explanation

Authentication verifies that a subject is who it claims to be. Authorization determines what that subject may do, while accounting and auditing concern logging and review of activity.

Question 8Identify and Access Management Fundamentals

A company wants centrally managed authentication where user credentials are stored in a directory and applications query that directory. Which technology best fits?

  1. Public key infrastructure
  2. Data loss prevention
  3. Security information and event management
  4. LDAP directory service Correct answer.

Explanation

An LDAP directory service stores identity and credential data centrally and lets applications query it for authentication and directory lookups. PKI manages certificates, SIEM aggregates logs, and DLP protects data content.

Question 9Identify and Access Management Fundamentals

Which statement correctly distinguishes identification from authentication?

  1. Identification proves identity, while authentication claims it.
  2. Both terms describe the same verification step.
  3. Identification claims an identity, while authentication verifies that claim. Correct answer.
  4. Authentication assigns permissions, while identification verifies credentials.

Explanation

Identification is the act of asserting an identity, such as supplying a username. Authentication is the subsequent verification of that assertion using credentials or factors.

Question 10Identify and Access Management Fundamentals

An administrator assigns permissions directly to individual user accounts, and the organization struggles to review access as staff change roles. Which practice would most improve governance?

  1. Shortening session timeout values
  2. Assigning permissions to groups or roles instead of individuals Correct answer.
  3. Increasing password length requirements
  4. Disabling audit logging to reduce noise

Explanation

Group- or role-based assignment centralizes entitlements so reviews and role changes are manageable. Password length, logging, and timeouts affect security posture but do not fix scattered per-user entitlements.

Question 11Identify and Access Management Fundamentals

Which characteristic makes a biometric factor stronger than a knowledge factor for authentication?

  1. It is difficult to share or guess. Correct answer.
  2. It can be reset easily if compromised.
  3. It requires no enrollment process.
  4. It is always cheaper to deploy.

Explanation

Biometrics are tied to a person and are hard to guess or transfer to another individual, unlike a password that can be shared or guessed. They are difficult to reset, require enrollment, and are often costly.

Question 12Identify and Access Management Fundamentals

A federated identity arrangement using SAML primarily exchanges which artifact between an identity provider and a service provider?

  1. A database backup
  2. A signed assertion about the user's identity and attributes Correct answer.
  3. A network packet capture
  4. A copy of the user's password hash

Explanation

SAML federation relies on signed assertions issued by the identity provider that convey authentication and attribute statements to the service provider. Passwords and password hashes are not shared across the federation.

Question 13Identify and Access Management Fundamentals

Which control best limits the damage if a user's credentials are stolen?

  1. Requiring multifactor authentication Correct answer.
  2. Increasing the number of roles per user
  3. Removing account lockout thresholds
  4. Publishing the password policy internally

Explanation

Multifactor authentication requires an additional factor beyond the password, so stolen credentials alone are insufficient to authenticate. The other options either do nothing for credential theft or weaken protections.

Question 14Identify and Access Management Fundamentals

In role-based access control, what is the purpose of role engineering?

  1. To monitor network traffic for anomalies
  2. To define roles that accurately reflect job functions and their needed permissions Correct answer.
  3. To encrypt role definitions at rest
  4. To rotate the credentials of privileged users

Explanation

Role engineering is the analysis that produces roles mapped to actual job responsibilities and the minimum permissions each needs. It is a design activity, not an encryption, credential rotation, or monitoring task.

Question 15Identify and Access Management Fundamentals

A resource owner sets read permissions for a colleague on a shared file. Which access control model does this exemplify?

  1. Discretionary access control Correct answer.
  2. Mandatory access control
  3. Attribute-based access control
  4. Role-based access control

Explanation

In discretionary access control the owner of the resource decides who receives access, which matches the owner granting read permission. MAC relies on system labels, RBAC on roles, and ABAC on evaluated attributes.

Question 16Identify and Access Management Fundamentals

Which statement best describes the function of an identity provider (IdP) in federated access?

  1. It authenticates the user and issues assertions that relying parties trust Correct answer.
  2. It authorizes every transaction inside each application
  3. It replaces the need for any access policy
  4. It stores all application data for relying parties

Explanation

The identity provider authenticates users and issues trusted assertions that relying parties, such as service providers, consume. Applications still hold their own data and enforce their own authorization policy.

Question 17Identify and Access Management Fundamentals

Which practice most directly supports the accuracy of access reviews?

  1. Reconciling granted entitlements against current job roles and documenting approvals Correct answer.
  2. Rotating encryption keys quarterly
  3. Increasing the minimum password age
  4. Blocking all outbound network traffic

Explanation

Access reviews are effective when entitlements are compared with current responsibilities and decisions are documented. Key rotation, traffic blocking, and password age settings do not validate whether access is still appropriate.

Question 18Identify and Access Management Fundamentals

What is the main security benefit of just-in-time privileged access?

  1. Privileged accounts never require authentication
  2. Audit logs can be disabled during the window
  3. Privileges are granted only for a limited window and then removed Correct answer.
  4. All users permanently hold administrative rights

Explanation

Just-in-time access grants elevated rights temporarily and revokes them automatically, shrinking the window an attacker could exploit. It does not bypass authentication, grant permanent rights, or justify disabling logging.

Question 19Identify and Access Management Fundamentals

Which element of AAA records what an authenticated user did with resources for later review?

  1. Authorization
  2. Authentication
  3. Accounting Correct answer.
  4. Assertion

Explanation

Accounting captures activity such as resource usage and session details for later auditing. Authentication verifies identity, authorization decides permitted actions, and an assertion is a federation statement.

Question 20Identify and Access Management Fundamentals

An organization wants access decisions that consider user department, device posture, time of day, and resource sensitivity together. Which model is most suitable?

  1. Mandatory access control
  2. Role-based access control
  3. Discretionary access control
  4. Attribute-based access control Correct answer.

Explanation

ABAC evaluates multiple attributes of the subject, resource, and environment in a policy decision, matching the combined criteria described. RBAC, DAC, and MAC rely on roles, owner discretion, or labels respectively.

Question 21Identify and Access Management Fundamentals

A security architect must ensure that a compromised service account cannot be used to escalate privileges across the environment. Which combination best addresses this?

  1. Least privilege for the account plus monitoring of its activity Correct answer.
  2. Storing the account credential in source code plus rotating annually
  3. Granting the account domain administrator rights to simplify operations
  4. A longer password plus a shared distribution list

Explanation

Limiting the service account to only needed permissions contains the blast radius, and monitoring detects misuse. Longer shared passwords, embedded credentials, and excessive rights all increase risk.

Question 22Identify and Access Management Fundamentals

Which statement about the relationship between authentication and authorization is accurate?

  1. Authentication establishes identity, and authorization uses that identity to decide access. Correct answer.
  2. Authorization verifies credentials, and authentication assigns permissions.
  3. Authorization must succeed before authentication occurs.
  4. Authentication and authorization are performed by the same mandatory component in all systems.

Explanation

Authentication establishes who the subject is, and authorization evaluates that established identity against policy to permit or deny actions. The sequence and components vary by system, but the conceptual roles do not reverse.

Question 23Identify and Access Management Fundamentals

An attacker replays a captured SAML assertion to a service provider. Which control most directly prevents successful reuse?

  1. Disabling transport encryption
  2. Removing signature verification to speed processing
  3. Short assertion validity windows combined with audience and recipient restrictions Correct answer.
  4. Longer user passwords

Explanation

Limiting assertion lifetime and binding assertions to a specific audience and recipient prevents captured assertions from being reused elsewhere or later. Password length, weaker transport, and skipped signature checks do not stop replay.

Question 24Identify and Access Management Fundamentals

In a mandatory access control system, which factor determines whether a subject may access an object?

  1. The resource owner's discretionary grant
  2. The subject's clearance compared with the object's classification label Correct answer.
  3. The subject's membership in a project role
  4. The time of day the request is made

Explanation

MAC enforces system-defined labels, so access depends on comparing the subject's clearance with the object's classification. Owner grants, role membership, and time-of-day are features of DAC, RBAC, and contextual policies.

Question 25Identify and Access Management Fundamentals

A firm wants to reduce standing administrative rights while preserving emergency access during incidents. Which approach best balances these goals?

  1. Sharing one administrator password across the team
  2. Disabling logging on administrative accounts
  3. Permanent administrator rights for all engineers
  4. Break-glass accounts that are vaulted, monitored, and rotated after use Correct answer.

Explanation

Break-glass accounts provide controlled emergency access when vaulted, monitored, and rotated after use, limiting standing privilege. Permanent rights, shared passwords, and disabled logging increase risk and reduce accountability.

Question 26Identify and Access Management Fundamentals

Which factor of authentication is a hardware token that generates a time-based one-time code?

  1. Something you are
  2. Something you have Correct answer.
  3. Somewhere you are
  4. Something you know

Explanation

Authentication factors are grouped by the nature of the evidence presented. A hardware token is a physical object the user possesses, which makes it a possession factor regardless of the code it displays.

Question 27Identify and Access Management Fundamentals

Which access control model bases a subject's access on a security label compared with the object's classification, with no discretion left to the object owner?

  1. Mandatory access control Correct answer.
  2. Role-based access control
  3. Attribute-based access control
  4. Discretionary access control

Explanation

In mandatory access control, the system enforces decisions by comparing subject clearance labels with object classification labels, and owners cannot override those rules. Discretionary models instead let the owner grant access at will.

Question 28Identify and Access Management Fundamentals

An organization wants users to authenticate once and then reach several independent cloud applications without signing in again to each one. Which capability delivers this?

  1. Single sign-on through a trusted identity provider Correct answer.
  2. Password synchronization across each application
  3. Periodic forced password rotation
  4. Per-application local account provisioning

Explanation

Single sign-on lets a user authenticate once to a central identity provider, which then issues assertions or tokens that relying applications accept. This removes separate sign-ins while keeping authentication centralized.

Question 29Identify and Access Management Fundamentals

A user is granted the ability to approve invoices because the user belongs to the accounts payable approver role, and permissions are attached only to that role. Which access control model is in use?

  1. Discretionary access control
  2. Rule-based access control
  3. Mandatory access control
  4. Role-based access control Correct answer.

Explanation

Role-based access control assigns permissions to roles and then assigns users to roles, so entitlements follow the job function rather than the individual. This centralizes administration and simplifies review.

Question 30Identify and Access Management Fundamentals

An identity team is designing a joiner-mover-leaver process. Which design choice most directly reduces the risk that a transferred employee retains entitlements from a previous position?

  1. Requiring the employee to sign a new acceptable use policy at transfer
  2. Suspending the account until the employee requests needed access manually
  3. Triggering a role re-evaluation that removes old entitlements and grants only those for the new position Correct answer.
  4. Increasing the frequency of organization-wide access certifications

Explanation

The mover event should drive an entitlement change so that access matches the new role at the moment of transfer. Removing prior entitlements and granting only the new role's permissions closes the accumulation-of-privilege gap.

Question 31Identity Governance and Administration

Which process is responsible for granting a user the access rights needed to perform their job on their first day of employment?

  1. Access certification
  2. Access provisioning Correct answer.
  3. Access revocation
  4. Role mining

Explanation

Provisioning is the process of creating and assigning accounts and entitlements to a user, typically triggered by a joiner event. It establishes the access a user needs to begin work.

Question 32Identity Governance and Administration

What is the primary purpose of the identity lifecycle's 'mover' event?

  1. To permanently delete the user's identity record
  2. To archive the user's historical audit logs
  3. To adjust access when a user changes roles or departments Correct answer.
  4. To reset the user's password on a schedule

Explanation

A mover event occurs when a user's job or organizational position changes, requiring access to be added, removed, or modified to match the new role. It prevents both over-provisioning and access gaps during transitions.

Question 33Identity Governance and Administration

In role-based access control, what is a 'role' best described as?

  1. A unique identifier for each individual user
  2. A collection of permissions associated with a job function Correct answer.
  3. A cryptographic key used to sign audit records
  4. A rule that evaluates user attributes at login time

Explanation

In RBAC, a role bundles permissions that correspond to a job function, and users are assigned roles rather than individual permissions. This abstraction simplifies administration and review.

Question 34Identity Governance and Administration

Which access control model bases decisions on characteristics such as department, location, and time of day?

  1. Attribute-based access control Correct answer.
  2. Role-based access control
  3. Discretionary access control
  4. Mandatory access control

Explanation

Attribute-based access control evaluates policies against attributes of the subject, resource, and environment. This allows fine-grained decisions incorporating context like location and time.

Question 35Identity Governance and Administration

What is separation of duties designed to prevent?

  1. Administrators reviewing their own access assignments
  2. Users sharing a single sign-on session across applications
  3. Accounts being provisioned before the start date
  4. A single user holding conflicting access that enables fraud or error Correct answer.

Explanation

Separation of duties ensures that no single person controls all parts of a sensitive transaction, reducing fraud and error risk. Conflicting entitlements held by one user are the primary target of SoD controls.

Question 36Identity Governance and Administration

What is the main goal of an access certification campaign?

  1. To confirm that existing access remains appropriate Correct answer.
  2. To discover new roles from usage data
  3. To onboard new users faster
  4. To automate password synchronization

Explanation

Certification campaigns require reviewers to attest that each user's access is still justified. The outcome is remediation of access found to be inappropriate.

Question 37Identity Governance and Administration

Which entity in an identity governance system typically represents a person independent of any specific application account?

  1. The entitlement
  2. The identity Correct answer.
  3. The role
  4. The policy

Explanation

The identity is the authoritative record of a person or thing, to which accounts and entitlements are linked. It persists across applications and lifecycle events.

Question 38Identity Governance and Administration

What does a 'leaver' event in the identity lifecycle primarily require?

  1. Expanding the user's entitlements
  2. Recalculating role mining results
  3. Assigning a temporary contractor role
  4. Timely revocation of all access Correct answer.

Explanation

When a user leaves, all accounts and entitlements must be disabled or removed promptly to prevent unauthorized access. Timeliness is critical because orphaned accounts are a common attack path.

Question 39Identity Governance and Administration

An organization wants to ensure that a user's access is automatically removed within one hour of HR recording a termination. Which capability is most directly required?

  1. A password complexity policy
  2. A quarterly manual access review
  3. A role mining exercise
  4. An automated deprovisioning workflow triggered by the HR system Correct answer.

Explanation

Meeting a one-hour revocation target requires automated deprovisioning driven by an authoritative HR event. Manual or periodic processes cannot achieve near-real-time removal.

Question 40Identity Governance and Administration

A reviewer is asked to certify access for a group of users but is also one of those users. Which practice best preserves the integrity of the campaign?

  1. Skip the reviewer's access entirely
  2. Certify the reviewer's access using an automated rule only
  3. Route the reviewer's own access to a different reviewer Correct answer.
  4. Allow the self-review because the reviewer is trusted

Explanation

Self-certification creates a conflict of interest and weakens the control. Routing the reviewer's own entitlements to an independent reviewer maintains objectivity.

Question 41Identity Governance and Administration

Which approach to role design produces roles that are tightly aligned with actual job duties but may require more roles overall?

  1. Broad roles based on department only
  2. Granular roles mapped to specific job functions Correct answer.
  3. A single global role for all employees
  4. Roles defined by application vendor defaults

Explanation

Granular, function-based roles align closely with real duties and reduce excess access, at the cost of a larger role catalog. The tradeoff is administrative complexity versus least privilege.

Question 42Identity Governance and Administration

What is the primary benefit of a role mining exercise?

  1. It automatically revokes dormant accounts
  2. It encrypts entitlements at rest
  3. It replaces the need for access certification
  4. It reveals patterns of access that can inform role definitions Correct answer.

Explanation

Role mining analyzes existing entitlement assignments to find common access patterns that can become candidate roles. It informs role design but does not itself enforce or revoke access.

Question 43Identity Governance and Administration

A user is granted the ability to both create vendors and approve vendor payments. Which control is most directly violated?

  1. Data retention
  2. Password aging
  3. Session timeout
  4. Separation of duties Correct answer.

Explanation

Creating vendors and approving their payments are conflicting duties that together enable fraud. Separation of duties requires these to be held by different people.

Question 44Identity Governance and Administration

Which practice most directly supports the principle of least privilege?

  1. Granting access in bulk to speed onboarding
  2. Assigning all users to a shared administrator account
  3. Retaining access after a role change for convenience
  4. Granting only the entitlements required for the current task Correct answer.

Explanation

Least privilege means granting the minimum access necessary for the user's duties. Limiting entitlements to what the task requires directly implements this principle.

Question 45Identity Governance and Administration

What is a 'toxic combination' in access governance?

  1. A role that has never been certified
  2. A policy that applies to more than one department
  3. A set of entitlements that individually are benign but together create risk Correct answer.
  4. An account with an expired password

Explanation

A toxic combination is a pairing of access rights that, when held together, enable a risky outcome such as fraud. Detection focuses on the combination rather than any single entitlement.

Question 46Identity Governance and Administration

An auditor asks how the organization knows which manager approved a specific entitlement. Which capability provides this evidence?

  1. An approval audit trail tied to the request Correct answer.
  2. Password vault logs
  3. Network firewall logs
  4. Role mining reports

Explanation

Access requests routed through an approval workflow generate an audit trail recording who approved what and when. This trail is the evidence of authorization.

Question 47Identity Governance and Administration

Which statement best describes the relationship between an identity and its accounts?

  1. Each identity may have only one account across all systems
  2. Each account must map to exactly one identity, and one identity may have many accounts Correct answer.
  3. Accounts exist independently and are never linked to identities
  4. Identities are created only after all accounts are provisioned

Explanation

An identity is the authoritative person record, and it can be linked to multiple accounts across different systems. Each account should resolve to exactly one identity to preserve accountability.

Question 48Identity Governance and Administration

What is the purpose of an authoritative source in identity governance?

  1. To host the certification campaign UI
  2. To provide the trusted record of identity and employment data Correct answer.
  3. To encrypt entitlement data
  4. To store application-specific passwords

Explanation

The authoritative source, often an HR system, is the trusted origin of identity and employment attributes. Governance processes rely on it to drive accurate provisioning and lifecycle events.

Question 49Identity Governance and Administration

A manager approves an access request without reviewing the details because the workflow defaults to approval. Which control weakness does this illustrate?

  1. Excessive logging
  2. Rubber-stamping in approvals Correct answer.
  3. Insufficient encryption
  4. Overly granular roles

Explanation

Rubber-stamping occurs when approvers routinely approve without genuine review, undermining the control's value. Mitigations include risk-based routing and requiring justification.

Question 50Identity Governance and Administration

Which metric best indicates the timeliness of offboarding controls?

  1. Number of roles defined in the catalog
  2. Average time from termination event to account disablement Correct answer.
  3. Count of certification campaigns per year
  4. Percentage of users with strong passwords

Explanation

Measuring the elapsed time between a termination and the disabling of accounts directly reflects offboarding timeliness. Shorter intervals indicate stronger lifecycle controls.