I85PREP
⌘ K
CIIM study materials
CIIM study resources

CIIM practice questions

One question at a time. Build your CIIM understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Identity Governance

In identity governance, which term describes the authoritative source record from which a user's identity attributes are provisioned to downstream systems?

  1. System of record Correct answer.
  2. Access recertification
  3. Role mining
  4. Segregation of duties

Explanation

A system of record is the authoritative repository, such as an HR platform, that holds the master identity data. Downstream applications consume provisioned attributes from it rather than maintaining their own copies. Role mining and recertification are governance processes, not authoritative data sources.

Question 2Identity Governance

An organization wants each application to receive only the identity attributes it actually needs. Which governance practice best supports this?

  1. Password synchronization
  2. Single sign-on federation
  3. Self-service password reset
  4. Attribute-based provisioning scoping Correct answer.

Explanation

Scoping provisioning so each target receives only the attributes it requires limits data exposure and supports least-privilege data sharing. Password synchronization, self-service reset, and federation address authentication convenience, not attribute minimization.

Question 3Identity Governance

What is the primary purpose of an access request and approval workflow in identity governance?

  1. To archive audit logs for retention
  2. To capture business justification and authorize entitlements before they are granted Correct answer.
  3. To synchronize passwords between directories
  4. To encrypt credentials stored in the directory

Explanation

An access request workflow records the business need for an entitlement and routes it to an accountable approver before provisioning occurs. This creates an authorization trail that supports audit and least privilege. Encryption, password synchronization, and log retention are separate technical controls.

Question 4Identity Governance

Which outcome indicates that a role mining exercise has produced a useful candidate role?

  1. A cluster of users sharing a coherent set of entitlements that maps to a business function Correct answer.
  2. A report of all failed authentication attempts
  3. A list of every entitlement held by any single user
  4. A count of orphan accounts by application

Explanation

Role mining groups existing entitlements into clusters that reflect common job functions, which can then be reviewed as candidate roles. Raw entitlement inventories and authentication or orphan reports are operational data, not role candidates.

Question 5Identity Governance

During an access recertification campaign, what is the reviewer primarily asked to confirm?

  1. That each user has completed security awareness training
  2. That each application has a current disaster recovery plan
  3. That each user's existing entitlements remain business-appropriate Correct answer.
  4. That each password meets the current complexity policy

Explanation

Recertification asks managers or resource owners to attest that assigned access is still justified for each user. Training completion, DR planning, and password policy are separate control activities.

Question 6Identity Governance

Which identity lifecycle event most commonly triggers immediate revocation of all downstream access?

  1. A manager changing cost centers
  2. A user updating a phone number
  3. A user completing annual training
  4. Termination of employment Correct answer.

Explanation

Termination removes the business justification for any access, so provisioning systems should disable the identity and revoke entitlements promptly. Contact updates, training completion, and cost center changes do not eliminate the need for access.

Question 7Identity Governance

What does the principle of least privilege require in an identity governance program?

  1. Users retain prior access to ease future role changes
  2. Administrators hold permanent elevated rights for convenience
  3. Access is granted broadly and reviewed only at termination
  4. Users receive only the access necessary to perform their current job duties Correct answer.

Explanation

Least privilege limits entitlements to what is needed for current responsibilities, reducing the attack surface and blast radius of misuse. Retaining stale access, standing admin rights, and termination-only reviews all violate the principle.

Question 8Identity Governance

Which artifact documents the approved relationship between a business role and the entitlements it grants?

  1. Role definition Correct answer.
  2. Password vault
  3. Access request ticket
  4. Orphan account report

Explanation

A role definition specifies the entitlements bundled into a business role and the rationale for them. Request tickets are transactional, orphan reports are cleanup outputs, and vaults store secrets.

Question 9Identity Governance

A manager approves a request for a finance application for a new analyst, but the entitlement is never provisioned. Which governance control gap should be investigated first?

  1. The provisioning connector or workflow between the governance platform and the target application Correct answer.
  2. The retention period of the audit log
  3. The frequency of role mining runs
  4. The password complexity settings on the target application

Explanation

When approval succeeds but access does not appear, the likely failure is in the automated provisioning path or connector to the target system. Password policy, log retention, and role mining frequency do not execute grants.

Question 10Identity Governance

An auditor finds several accounts belonging to former contractors that remain enabled. Which governance process most directly prevents recurrence?

  1. Monthly log review
  2. Annual password rotation
  3. Automated lifecycle triggers that disable identities on contract end date Correct answer.
  4. Quarterly role mining

Explanation

Lifecycle automation tied to authoritative end dates ensures identities are disabled when the relationship ends. Password rotation, role mining, and log review do not automatically revoke access at termination.

Question 11Identity Governance

A user changes departments from sales to engineering. Which approach best reflects good joiner-mover-leaver governance?

  1. Grant engineering access without approval to avoid delay
  2. Disable the account and create a new identity
  3. Remove sales entitlements and grant engineering access through an approved role Correct answer.
  4. Retain all sales access while adding engineering access

Explanation

A mover event should strip entitlements no longer needed and grant new access through approved role assignment. Retaining old access creates accumulation, disabling the account disrupts continuity, and skipping approval violates control requirements.

Question 12Identity Governance

Which segregation of duties conflict is present when a single user can both create a vendor record and approve payments to that vendor?

  1. A violation of password complexity requirements
  2. An orphan account without an assigned owner
  3. A conflicting combination of create and approve capabilities in the procure-to-pay process Correct answer.
  4. A missing disaster recovery plan for the ERP system

Explanation

Segregation of duties prevents one person from controlling both creation and approval steps that could conceal fraud. The scenario describes a toxic combination of entitlements, not a password, availability, or ownership issue.

Question 13Identity Governance

A governance team wants to detect toxic access combinations before access is granted rather than after. Which control placement achieves this?

  1. An annual external audit
  2. A preventive SoD policy check embedded in the access request workflow Correct answer.
  3. A post-incident review process
  4. A monthly report of all entitlements

Explanation

Embedding SoD policy evaluation in the request workflow blocks conflicting entitlements at the point of grant. Monthly reports, annual audits, and post-incident reviews are detective or reactive and allow the conflict to exist temporarily.

Question 14Identity Governance

What distinguishes an orphan account in identity governance?

  1. An account with an expired password
  2. An account belonging to a privileged administrator
  3. An account with no valid owner or matching authoritative identity Correct answer.
  4. An account created through an approved request

Explanation

An orphan account lacks a link to a current authoritative identity or accountable owner, so no one is responsible for reviewing it. Expired passwords, privileged status, and approved creation do not define orphan status.

Question 15Identity Governance

A resource owner is asked to certify access for 4,000 users in a single campaign. Which practice most improves certification quality?

  1. Assigning every review to a single administrator
  2. Extending the campaign indefinitely until all items are signed
  3. Removing all context to keep the review fast
  4. Scoping reviews to risky entitlements and providing reviewers with usage context Correct answer.

Explanation

Risk-based scoping and contextual data such as last-login or job role help reviewers make informed decisions and reduce rubber-stamping. Removing context, concentrating reviews, and open-ended extensions undermine quality.

Question 16Identity Governance

Why should emergency or break-glass access be time-bound and logged?

  1. To eliminate the need for authentication
  2. To limit standing privilege and preserve accountability for exceptional use Correct answer.
  3. To allow permanent administrator access
  4. To avoid documenting changes made during the emergency

Explanation

Break-glass accounts bypass normal controls, so time-boxing limits exposure while logging preserves an audit trail of who used elevated access and why. Removing authentication, granting permanence, and skipping documentation all defeat the control.

Question 17Identity Governance

Which metric best indicates whether access recertification is driving remediation rather than just review activity?

  1. Average time to send campaign invitations
  2. Total count of entitlements in the environment
  3. Number of reviewers invited to the campaign
  4. Percentage of reviewed entitlements that were revoked or modified Correct answer.

Explanation

The share of entitlements actually revoked or changed shows that review decisions produce remediation. Invitation counts, entitlement totals, and invitation latency measure activity volume rather than outcomes.

Question 18Identity Governance

A company defines roles by department only, and users frequently need cross-department access. What is the most likely weakness of this role model?

  1. Roles are too coarse to express actual job functions, causing excessive exceptions Correct answer.
  2. Roles are too granular, causing role explosion
  3. Roles bypass the approval workflow entirely
  4. Roles automatically violate segregation of duties

Explanation

Department-only roles bundle access too broadly relative to real duties, so users accumulate exceptions to obtain what they need. The problem is coarseness rather than explosion, and role design does not inherently bypass approvals or force SoD conflicts.

Question 19Identity Governance

Which data flow correctly describes authoritative provisioning?

  1. Password vault to email gateway to HR system of record
  2. Helpdesk ticketing to target application to identity governance platform
  3. HR system of record to identity governance platform to target applications Correct answer.
  4. Target application to HR system of record to helpdesk ticketing

Explanation

Authoritative attributes originate in the HR system, are consolidated and governed in the identity platform, and then flow to targets. The other sequences originate from non-authoritative systems and would propagate unreliable data.

Question 20Identity Governance

An access review reveals that a user holds an entitlement granted through a role and also through a direct assignment. Which governance issue does this illustrate?

  1. A missing disaster recovery test
  2. An expired certification campaign
  3. A password synchronization failure
  4. Entitlement accumulation across multiple grant paths Correct answer.

Explanation

When the same or overlapping access arrives through both role-based and direct assignment, entitlements accumulate and become hard to govern. The duplicate grant path is an assignment design issue, not a credential, campaign, or availability problem.

Question 21Identity Governance

A governance architect must choose between role-based access control and attribute-based policies for a highly dynamic workforce. Which consideration most strongly favors attribute-based policies?

  1. Access decisions can incorporate changing context such as location, project, and clearance without defining a new role each time Correct answer.
  2. Attribute policies require no authoritative identity data
  3. Attribute policies always produce fewer entitlements than roles
  4. Attribute policies eliminate the need for any access reviews

Explanation

Attribute-based policies evaluate contextual attributes at decision time, which suits environments where duties change faster than static roles can be maintained. They do not remove review obligations, still depend on authoritative data, and do not guarantee fewer entitlements.

Question 22Identity Governance

During a merger, two identity platforms must be consolidated. Which sequencing decision best reduces governance risk?

  1. Disable both platforms and rebuild access manually from memory
  2. Establish a single authoritative identity source and reconcile duplicate identities before migrating entitlements Correct answer.
  3. Allow both platforms to provision the same targets indefinitely
  4. Migrate all entitlements first and reconcile identities afterward

Explanation

Consolidating authoritative identity and resolving duplicates first prevents entitlements from attaching to the wrong identities during migration. Migrating first, manual rebuilding, and indefinite dual provisioning all create duplication and orphan risk.

Question 23Identity Governance

A risk model scores entitlements by data sensitivity and user privilege. How should certification campaigns use these scores?

  1. Exclude high-risk entitlements from review to reduce workload
  2. Use scores only for password policy enforcement
  3. Prioritize high-risk entitlements for more frequent, more scrutinized review Correct answer.
  4. Apply identical review depth to every entitlement regardless of score

Explanation

Risk scoring lets governance focus reviewer attention where impact is greatest, so sensitive and privileged access receives deeper and more frequent scrutiny. Uniform depth ignores risk, exclusion removes oversight, and scores are not a credential policy input.

Question 24Identity Governance

An organization discovers that service accounts are not included in any recertification campaign. What is the most significant governance consequence?

  1. Non-human identities with potentially excessive privilege remain unreviewed and unaccountable Correct answer.
  2. Audit logs will stop being generated
  3. Role mining will produce too many candidate roles
  4. Password complexity settings will automatically weaken

Explanation

Service accounts often hold broad privileges and, if excluded from review, accumulate access with no accountable owner. Their omission does not affect password complexity, role mining output, or log generation directly.

Question 25Identity Governance

A governance program wants to prove that approvals are meaningful rather than rubber-stamped. Which evidence is most persuasive?

  1. A high volume of approvals completed in seconds per item
  2. A low rate of automatic bulk approvals combined with documented revocations after review Correct answer.
  3. A long campaign duration spanning several months
  4. A large number of reviewers assigned to each campaign

Explanation

Meaningful approval is evidenced by individualized decisions and actual revocations rather than volume or speed. Instant bulk approvals, large reviewer counts, and long durations can indicate process burden rather than review quality.

Question 26Identity Governance

Which identity governance capability provides a single authoritative record of who has access to which resources, from which source, and under what approval?

  1. A network access control list on the perimeter firewall
  2. An entitlement catalog linked to identity and resource records Correct answer.
  3. A ticketing queue for password reset requests
  4. A password vault with rotation schedules

Explanation

Identity governance depends on an authoritative inventory that ties each identity to each entitlement and resource, including provenance such as role, direct grant, or birthright rule. Without this linkage, certification, segregation-of-duties analysis, and audit reporting cannot be performed reliably.

Question 27Identity Governance

A governance team wants to model access so that a user's effective entitlements are computed from rules over department, location, clearance, and project attributes rather than from static assignments. Which model are they implementing?

  1. Role mining from historical usage logs
  2. Policy-based access control evaluated at request time Correct answer.
  3. Manual provisioning with manager sign-off
  4. Discretionary access control based on owner decisions

Explanation

Policy-based (attribute-driven) access control derives effective entitlements from evaluated rules over identity and resource attributes, so access adapts as attributes change. Role mining produces candidate roles from observed usage, and discretionary or manual models rely on human decisions rather than computed policy.

Question 28Identity Governance

In a role lifecycle methodology, what is the primary purpose of the role mining stage that precedes role definition?

  1. To certify existing roles with business owners
  2. To archive roles that are no longer requested
  3. To enforce segregation-of-duties rules at provisioning
  4. To discover recurring entitlement patterns in actual assignment data as candidate role content Correct answer.

Explanation

Role mining analyzes existing assignment and usage data to surface clusters of entitlements that tend to be granted together, which then inform candidate role definitions. Certification, enforcement, and retirement occur in later lifecycle stages after roles have been defined and approved.

Question 29Identity Governance

A governance analyst must decide whether a proposed new role should be created or an existing role extended. Which consideration most directly supports creating a separate role?

  1. The proposed entitlements serve a distinct job function with its own owner and risk profile Correct answer.
  2. The existing role has not been recertified in the current campaign
  3. The proposed entitlements are requested by a large number of users
  4. The existing role name does not match the department naming convention

Explanation

Role granularity should reflect distinct job functions with clear ownership and risk, which keeps certification meaningful and SoD analysis precise. Volume of requests or cosmetic naming issues are weak reasons to fragment the role model.

Question 30Identity Governance

Which statement correctly distinguishes authentication from authorization in an identity governance context?

  1. Both terms describe the same check performed at the identity provider
  2. Authentication determines what a user may do; authorization verifies who the user is
  3. Authorization occurs only during joiner onboarding, while authentication occurs at every login
  4. Authentication verifies identity; authorization determines which entitlements the identity may exercise Correct answer.

Explanation

Authentication establishes that a subject is who it claims to be, while authorization decides which resources and actions that subject may use. Governance focuses on the authorization side, ensuring entitlements are appropriate, approved, and reviewed.

Question 31Identity Governance

A governance program needs to demonstrate that access decisions are attributable to a specific accountable person rather than to a shared team mailbox. Which control design achieves this?

  1. Allowing approvers to delegate permanently to an administrative assistant
  2. Accepting verbal approval confirmed later by email
  3. Routing approvals to a group mailbox monitored by the team
  4. Requiring each approver to authenticate individually and recording their identity with the decision Correct answer.

Explanation

Attributable approval requires that the decision be bound to an authenticated individual identity and stored with the request record. Shared mailboxes, permanent delegation, and retrospective verbal confirmation break the link between decision and accountable person.

Question 32Identity Governance

Which policy element most directly limits how long a contractor retains access after a project milestone is reached?

  1. A quarterly phishing simulation
  2. A password complexity standard
  3. A session timeout on the VPN concentrator
  4. An access expiration or time-bound grant tied to the engagement end date Correct answer.

Explanation

Time-bound grants and expiration dates cause access to lapse automatically when the engagement or milestone ends, which is the governance mechanism for temporary workers. Password standards, session timeouts, and awareness training address different risks.

Question 33Identity Governance

A governance lead is designing the request catalog for a new platform. Which catalog design best supports both usability and control?

  1. Expose only entitlements that have never been requested before
  2. Expose every low-level entitlement individually with no grouping or description
  3. Hide the catalog and require users to submit free-text tickets to the service desk
  4. Expose business-friendly requestable items that bundle entitlements and carry approval and risk metadata Correct answer.

Explanation

A requestable catalog should present business-meaningful items with attached approval routing, risk rating, and bundled entitlements so that requests are understandable and governed. Raw entitlement exposure or free-text tickets undermine both clarity and control.

Question 34Identity Governance

What is the primary governance purpose of a segregation-of-duties policy matrix?

  1. To list every user who currently holds privileged access
  2. To document the network zones where applications are hosted
  3. To record the password rotation schedule for administrative accounts
  4. To define which pairs of entitlements or duties must never be held by the same identity Correct answer.

Explanation

An SoD matrix codifies the incompatible duty pairs that create fraud or error risk, providing the rule set against which assignments are tested. Holder lists, password schedules, and network zoning serve other purposes.

Question 35Identity Governance

A preventive SoD control is being implemented for a procurement system. At which point should the policy be evaluated to prevent the conflicting combination from ever existing?

  1. During the annual access certification campaign
  2. When the user's manager changes departments
  3. In a monthly after-the-fact reconciliation report
  4. At the moment of access request or role assignment, before provisioning Correct answer.

Explanation

Preventive SoD enforcement evaluates the policy at request or assignment time so the conflicting combination is blocked before it is provisioned. Certification and reconciliation reports are detective controls that find conflicts after they exist.

Question 36Identity Governance

A governance team is building risk scoring for certification prioritization. Which combination of factors is most defensible for ranking entitlement risk?

  1. Data sensitivity of the target resource and the privilege level the entitlement confers Correct answer.
  2. Number of times the entitlement appears in the catalog and its display color
  3. Alphabetical order of entitlement names and date of creation
  4. Popularity of the entitlement among senior managers

Explanation

Risk ranking should reflect the potential impact of misuse, which is driven by the sensitivity of the data or system plus the level of privilege granted. Cosmetic or popularity-based factors do not correlate with impact.

Question 37Identity Governance

A certification campaign reviewer approves every item in under two seconds. Which campaign design change most directly improves the quality of review decisions?

  1. Removing risk context so reviewers are not biased
  2. Increasing the number of items per reviewer to reduce overhead
  3. Extending the campaign deadline by one week
  4. Scoping campaigns to reviewers who understand the access and surfacing risk indicators with each item Correct answer.

Explanation

Review quality improves when reviewers have genuine knowledge of the access and are given risk signals that focus attention on questionable items. Adding volume, stripping context, or extending deadlines does not address rubber-stamping.

Question 38Identity Governance

Which control best ensures that a terminated identity's sessions and tokens are invalidated promptly, not merely that the account is disabled?

  1. An email notification to the manager asking them to confirm termination
  2. A nightly batch job that disables accounts after HR reconciliation
  3. A quarterly review of terminated users by the security team
  4. A termination event that disables the account and revokes active sessions and refresh tokens in near real time Correct answer.

Explanation

Disabling an account does not necessarily invalidate already-issued sessions or refresh tokens, so termination handling must include active session and token revocation in near real time. Batch reconciliation, periodic review, and manager notification all leave a window of residual access.

Question 39Identity Governance

An organization wants to measure whether its joiner process grants access before the start date rather than after. Which metric is most appropriate?

  1. Average number of entitlements held per employee
  2. Count of certification campaigns completed this year
  3. Percentage of joiner requests provisioned on or before the employee start date Correct answer.
  4. Number of roles defined in the role catalog

Explanation

The relevant measure is timeliness of provisioning relative to the start date, which shows whether access is ready when work begins. Role counts, entitlement averages, and campaign counts measure other aspects of the program.

Question 40Identity Governance

A governance architect is integrating a new SaaS application that supports SCIM. What is the main governance benefit of using SCIM rather than a scheduled CSV import?

  1. It guarantees that all entitlements are automatically least-privilege
  2. It eliminates the need for any access approvals
  3. It enables near real-time, event-driven identity and entitlement synchronization that reduces stale access windows Correct answer.
  4. It replaces the need for certification campaigns

Explanation

SCIM provides a standard, event-driven interface for propagating identity and group changes, shrinking the period during which downstream access is out of step with the authoritative source. It does not remove approval, certification, or least-privilege obligations.

Question 41Access Management

In an identity and access management program, which term describes the process of proving that a claimed identity is genuine?

  1. Provisioning
  2. Authorization
  3. Authentication Correct answer.
  4. Federation

Explanation

Authentication verifies that a subject is who it claims to be, typically through something the subject knows, has, or is. Authorization happens only after successful authentication and determines which resources the subject may use. Provisioning and federation are lifecycle and trust mechanisms rather than proof of identity.

Question 42Access Management

A security team wants to reduce the risk that a single stolen password grants access to a critical system. Which control is most directly designed for this purpose?

  1. Password complexity policy
  2. Multi-factor authentication Correct answer.
  3. Password history enforcement
  4. Account lockout threshold

Explanation

Multi-factor authentication requires two or more independent credential types, so a stolen password alone is insufficient for access. Complexity, lockout, and history policies harden passwords but still rely on a single secret factor. Only MFA adds an independent factor that a password thief does not possess.

Question 43Access Management

Which access control model grants permissions based on the responsibilities a user holds within the organization rather than on the individual's identity?

  1. Mandatory access control
  2. Attribute-based access control
  3. Discretionary access control
  4. Role-based access control Correct answer.

Explanation

Role-based access control assigns permissions to roles and then assigns users to roles, so access follows job responsibilities. Discretionary control lets owners set permissions, mandatory control relies on system labels and clearances, and attribute-based control evaluates policies over many attributes. RBAC is the model defined by role membership.

Question 44Access Management

What is the primary purpose of the principle of least privilege in access management?

  1. To ensure every user has identical baseline permissions
  2. To log every access request for audit review
  3. To rotate administrative credentials on a fixed schedule
  4. To grant each subject only the access needed to perform its tasks Correct answer.

Explanation

Least privilege limits entitlements to the minimum required for a subject's duties, shrinking the blast radius of misuse or compromise. Uniform permissions, credential rotation, and logging are separate controls that do not restrict the scope of granted access. The defining characteristic is minimal necessary rights.

Question 45Access Management

Which activity belongs to the identity lifecycle stage known as joiner processing?

  1. Disabling accounts after an employee leaves
  2. Rotating privileged credentials periodically
  3. Creating the account and assigning initial entitlements Correct answer.
  4. Recertifying existing access each quarter

Explanation

Joiner processing covers onboarding: creating identities and granting the baseline access a new person needs. Disabling accounts belongs to leaver processing, while recertification and credential rotation are ongoing governance activities. The joiner stage is defined by account creation and initial entitlement assignment.

Question 46Access Management

A user signs in once and then accesses several independent applications without re-entering credentials. Which capability does this describe?

  1. Password vaulting
  2. Federated provisioning
  3. Single sign-on Correct answer.
  4. Just-in-time provisioning

Explanation

Single sign-on lets one authentication event establish a session usable across multiple trusted applications. Provisioning mechanisms create accounts, and vaulting stores credentials for retrieval, but neither provides a shared authenticated session. The described behavior is the definition of SSO.

Question 47Access Management

Which statement best describes the difference between identification and authentication?

  1. Identification applies only to machines, while authentication applies only to people
  2. Identification proves identity, while authentication claims it
  3. Identification claims an identity, while authentication verifies it Correct answer.
  4. Identification and authentication are performed only by administrators

Explanation

Identification is the act of presenting an identity claim such as a username, while authentication validates that claim. The two are sequential steps in access management and apply to both human and non-human subjects. Reversing their roles misstates the fundamental sequence.

Question 48Access Management

An organization wants a central repository that stores identities and attributes and can be queried by many applications. Which technology fits this requirement?

  1. A directory service Correct answer.
  2. A security information and event management system
  3. A web application firewall
  4. A data loss prevention tool

Explanation

A directory service stores identity objects and attributes and exposes them to consuming applications through standard protocols. Firewalls, SIEM platforms, and DLP tools address network filtering, event correlation, and data protection respectively. Only a directory serves as the identity repository.

Question 49Access Management

A company wants to enforce a rule that any user accessing the finance application must be in the finance department and must connect from a managed device. Which access control approach most naturally expresses this combined condition?

  1. Role-based access control using a single finance role
  2. Mandatory access control using classification labels
  3. Attribute-based access control evaluating department and device posture Correct answer.
  4. Rule-based access control using time-of-day restrictions only

Explanation

Attribute-based access control evaluates policies over multiple attributes of the subject, resource, and environment, which fits a combined department-and-device condition. A single role cannot express device posture, labels address classification rather than posture, and time-of-day rules alone cannot capture the required attributes. ABAC is designed for such multi-attribute decisions.

Question 50Access Management

During an access review, a manager notices that an employee who transferred from sales to engineering still holds sales reporting permissions. Which lifecycle problem does this illustrate?

  1. Privilege creep from incomplete mover processing Correct answer.
  2. Insufficient password complexity
  3. Missing federation trust configuration
  4. Excessive failed authentication attempts

Explanation

Mover processing should adjust entitlements when a person changes roles; failing to remove old access leaves accumulated rights, often called privilege creep. Failed logins, password complexity, and federation trust relate to authentication and trust configuration rather than stale entitlements. The scenario is a classic mover-handling gap.