CIIM study plan

Map the identity lifecycle (joiner, mover, leaver) and list the control points where governance and risk decisions intersect.

Define the core governance artifacts: identity policy, role catalog, access request and approval workflow, and periodic access review.

Draft a risk register with five identity risks (orphaned accounts, excessive entitlements, stale roles, toxic combinations, unowned service accounts) and score each by likelihood and impact.

Compare role-based, attribute-based, and policy-based access models and state one scenario where each is the better fit.

Design a quarterly access certification campaign: scope, reviewer assignment, evidence retention, and remediation SLA.

Build a segregation-of-duties matrix for a sample finance process with three conflicting role pairs.

Explain how entitlement mining and peer-group comparison surface excessive access, and outline the review step that follows detection.

Write the escalation path for certification failures, including who approves compensating controls and when access is revoked.

Diagram authentication flows for password, MFA, and phishing-resistant FIDO2 authenticators, noting where each is vulnerable.

Compare SSO federation patterns (SAML, OIDC) and identify the token and session risks each introduces.

Define session controls: timeout, re-authentication for sensitive actions, token binding, and revocation on risk signals.

Draft a step-up authentication policy that triggers on device posture, location, and behavior anomalies.

Model privileged access management: vaulting, just-in-time elevation, session recording, and break-glass procedures.

Design an authorization model for a multi-tenant SaaS application and justify the chosen policy enforcement point.

Identify five access-management risk indicators (dormant accounts, MFA gaps, shared credentials, over-broad OAuth scopes, orphaned API keys) and propose a metric for each.

Build a risk-scoring rubric that combines access-review outcomes with authentication telemetry.

Classify data by sensitivity and map each class to encryption, masking, and retention requirements.

Compare encryption at rest, in transit, and in use, and select the right key-management pattern (centralized KMS, HSM, envelope encryption) for two scenarios.

Design tokenization and data-masking controls for a customer analytics pipeline.

Draft a data-loss-prevention rule set for outbound email, cloud storage, and endpoint copy actions.

Trace how identity data flows through collection, storage, sharing, and deletion, and flag the privacy risks at each stage.

Explain the mechanics of account takeover: credential stuffing, phishing, session hijacking, and MFA fatigue, with the control that blunts each.

Design a fraud-detection rule set that combines device fingerprinting, velocity checks, and identity-proofing signals.

Write a breach-notification and containment runbook for a compromised identity, including token revocation and customer communication triggers.

Compare identity-proofing assurance levels and select the evidence required for low-, medium-, and high-risk onboarding journeys.

Design a synthetic-identity detection workflow that correlates document verification, biometric liveness, and behavioral signals.

Map fraud controls back to governance obligations: logging, consent, dispute handling, and audit evidence.

Draft a customer redress process for false declines and account lockouts caused by fraud rules.

Build a consolidated control catalog that tags every control to its domain, risk addressed, and evidence source.

Run two timed practice sets across all domains and log every missed question with the underlying concept.

Close knowledge gaps by re-deriving the three weakest concepts from first principles without notes.

Write a one-page exam-day strategy covering question triage, time allocation, and how to handle scenario questions with conflicting priorities.