Log in Start free
Home › ISC2 CC › Practice questions › Identity and Access Management (IAM) Concepts
ISC2 CC · ISC2 · Identity and Access Management (IAM) Concepts · Bank updated 2026-11-03

ISC2 CC practice questions: Identity and Access Management (IAM) Concepts

5 free questions from 48 on this area · answer and explanation for each · no sign-up

These 5 questions come from the Identity and Access Management (IAM) Concepts section of our ISC2 CC bank (48 questions on this area, which carries 20% of the real exam). Every question is original, with the correct answer explained and linked to the source it is drawn from.

Try 6 free ISC2 CC questions → All ISC2 CC sample questions

Free: 6 questions in study mode, no card. All 48 Identity and Access Management (IAM) Concepts questions and the full ISC2 CC bank: $15 one-time.

1/5 · Identity and Access Management (IAM) Concepts
A domain administrator opens a malicious invoice attachment on his workstation while signed in with his domain admin account, and ransomware spreads to servers across the whole domain. Which practice would most directly have limited the damage?
ARequire MFA at each sign-in to the domain admin account
BRemove local administrator rights on his workstation
CLimit Domain Admins group membership to staff who need it
DUse a separate non-admin account for his everyday work
Answer: D. NIST SP 800-53 Rev. 5, AC-6(2) Least Privilege | Non-privileged Access for Nonsecurity Functions, requires users with access to security functions to use non-privileged accounts or roles when accessing nonsecurity functions, and its discussion says this 'limits exposure when operating from within privileged accounts or roles.' Opening mail and attachments is not one of the security functions listed in AC-6(1), such as establishing system accounts or configuring access authorizations, so that work belongs in a non-privileged account. Source: ISC2 CC Exam Outline
2/5 · Identity and Access Management (IAM) Concepts
A bank's sign-in service checks a password, then looks at the user's device identity and geolocation and finds both familiar. A project lead says the sign-in is now multi-factor. How does the digital identity model treat the device and location checks?
Arisk evaluation inputs that do not count as authentication factors
Ba possession factor when the device is already registered to the user
Ca knowledge factor when the bank has stored both checks in advance
Dan inherence factor when the usual location pattern also matches
Answer: A. The three classic factors are something you know, have and are. Other information, such as location data or device identity, may help an RP or verifier judge the risk of a claimed identity, but it is not an authentication factor. The password alone is therefore still a single factor in this scenario. Source: NIST SP 800-63-3, Digital Identity Guidelines (2017), SP800633-p25, p. 25 Source: ISC2 CC Exam Outline
3/5 · Identity and Access Management (IAM) Concepts
A contractor's engagement ended last week, but she still has her smart card. At sign-in she passes the verifier's cryptographic challenge with the card's private key. What must the verifier still do before accepting her as the subscriber?
Aconfirm with the CSP that her credential is still valid today
Bsend a further challenge to be signed with a second key pair
Cpass the result to the RP so it can evaluate her authorizations
Drequire a memorized secret in addition to the smart card
Answer: A. Once the claimant has demonstrated possession and control of an authenticator, the verifier still verifies that the credential remains valid, usually by interacting with the CSP (4.3.3). A successful cryptographic challenge shows possession only. Authorization is a separate decision and is outside authentication (4.1). Source: NIST SP 800-63-3, Digital Identity Guidelines (2017), https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-3.pdf, 4.3.3 Authentication Process (SP800633-p27), p. 27 Source: ISC2 CC Exam Outline
4/5 · Identity and Access Management (IAM) Concepts · hard
A benefits service can run almost entirely on self-asserted attributes. A single attribute, the applicant's date of birth, must be validated and verified before the service can release a benefit online. How should the agency approach identity assurance?
Astay at IAL1 and let each applicant confirm the attributes personally
Bmove the whole service to in-person proofing at IAL3 for its users
Craise authentication to AAL3 while keeping the attributes self-asserted
Daccept attributes that were already proofed at IAL2 or IAL3 by a CSP
Answer: D. The IAL selection can be short-circuited to IAL1 only when the service works with self-asserted attributes. If even a single validated and verified attribute is needed, the provider will need to accept attributes that have been IAL2 or IAL3 proofed (6.1). The provider need not perform the proofing itself. Source: NIST SP 800-63-3, Digital Identity Guidelines (2017), https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-3.pdf, 6.1 Selecting IAL (SP800633-p41), p. 41 Source: ISC2 CC Exam Outline
5/5 · Identity and Access Management (IAM) Concepts
A verifier sends an assertion directly to an RP over a protected session. An engineer argues that, because the session is protected, the RP has nothing left to check. Which responsibility remains with the RP?
Aasking the subscriber to confirm the contents of the assertion
Bre-proofing the subscriber at the IAL that the verifier reports
Cauthenticating the verifier and confirming assertion integrity
Dvalidating the subscriber's credential directly with the CSP
Answer: C. The verifier must provide a mechanism for confirming assertion integrity, and where verifier and RP communicate directly a protected session may preserve it. The RP, however, remains responsible for authenticating the source of the assertion and confirming its integrity. Source: NIST SP 800-63-3, SP800633-p28 (4.4.1 Assertions), p. 28 Source: ISC2 CC Exam Outline
Try 6 more free ISC2 CC questions → See the whole ISC2 CC bank

Other ISC2 CC areas

The same kind of free sample for every other section of the ISC2 CC bank:

Security Principles64 qNetworking and Cloud Security Concepts49 qSecurity Governance22 qSecurity Operations and Incident Response53 q

Practise ISC2 CC with instant feedback

6 free questions in study mode · no card · full ISC2 CC bank with area filters and the error log: $15 one-time · no dumps, no ads.

Start ISC2 CC free →
Read next
Is ISC2 CC Still Worth It in 2026? The Free Exam Ended and the Outline Changed The free CC exam closed to new enrolments on 20 May 2026 and a new outline took effect on 1 September. Real cost, what changed and who should take it. ISC2 CC vs CompTIA Security+: Which Entry-Level Security Certification First CC asks for no experience and costs US$199; Security+ is broader, tests hands-on tasks and changes version on 17 November 2026. Which to take first.
All ISC2 CC practice questions → ISC2 CC exam format How to pass ISC2 CC ISC2 CC cost ISC2 CC eligibility
ExamDeck is an independent study tool, not affiliated with, endorsed by, or sponsored by ISC2. ISC2 CC and related marks are trademarks of their respective owners, used for identification only. Exam facts checked against official ISC2 materials (as of October 2026); always confirm current details with the vendor before booking.