5.0 Identity and Access Management (IAM) CISSP Practice Quiz

• A. Align physical and logical access controls with asset classification, business need, and risk tolerance
• B. Treat a building badge as if it automatically conferred privileges in every application
• C. Provision broadly permissive entitlements and depend on the SIEM to detect any abuse
• D. Exempt machine identities from the joiner-mover-leaver process altogether

Access to assets should reflect the value and sensitivity of the asset and the business purpose for access. This is the correct answer.

• A. Use separation between public, employee, privileged, and third-party access paths
• B. Default new users to elevated rights and trust monitoring to surface inappropriate use
• C. Exclude service principals from privileged access management coverage
• D. Rely on a key-locked rack as the only protection for the domain controller console

Different populations create different risks and require distinct control models. This is the correct answer.

• A. Use a single 'admin' account everyone shares for sensitive physical and logical entries
• B. Use badge controls, visitor management, locks, cameras, and guards for physical access to sensitive facilities
• C. Let physical entry into the data center auto-grant admin rights on the systems inside
• D. Skip least-privilege at provisioning time and use detective controls to catch misuse

Physical access controls reduce unauthorized entry and create accountability around protected areas. This is the correct answer.

• A. Equate door-reader admittance with full logical authorization across enterprise systems
• B. Protect privileged administrative interfaces with stronger authentication, monitoring, and limited access paths
• C. Choose detective controls over preventive ones for new privileged provisioning
• D. Treat non-human identities as out of scope for periodic recertification

Administrative access can change or bypass security controls and requires elevated protection. This is the correct answer.

• A. Use UEBA as a substitute for designing least-privilege roles in the first place
• B. Remove shared physical or logical access mechanisms where individual accountability is required
• C. Skip ownership assignment for service accounts so no one is accountable for them
• D. Skip console authentication on a privileged jump box because the rack is locked

Shared access weakens attribution and complicates investigations. This is the correct answer.

• A. Protect the privileged management console with only a locked equipment cabinet
• B. Have all admins log into a common privileged account for both buildings and systems
• C. Use network, application, database, and operating system controls to restrict logical access to information assets
• D. Conflate having an office key with being authorized to approve financial transactions

Logical controls enforce who or what can access systems and data. This is the correct answer.

• A. Standardize on a single shared 'manager' badge and login across all sensitive areas
• B. Provision system entitlements based solely on which floor of the building a user can enter
• C. Use access control matrices or policy models to map subjects, objects, and allowed operations
• D. Provision wide access by default and treat alerting as the primary line of defense

Structured access mapping helps validate whether permissions match intended business rules. This is the correct answer.

• A. Skip access reviews for service accounts because they are 'just background jobs'
• B. Treat the data center door as a sufficient compensating control for an unauthenticated console
• C. Issue one shared root credential used by every administrator across facilities and apps
• D. Apply need-to-know and least privilege across both physical facilities and logical systems

Users should receive only the access needed to perform authorized duties. This is the correct answer.