22 Identity Lifecycle Management Practice Questions & Answers
Every Identity Lifecycle Management practice question from the ISC2 Certified in Cybersecurity (CC) Practice Test, with the correct answer and a short explanation.
Start practice test →1. A company is documenting entitlements for a new finance application. Which statement reflects correct role definition in identity life cycle management?
- A.Permissions are attached to the cost centre code, so every member of that budget inherits them.
- B.Permissions are attached to each person by name, and a role label is recorded later for reporting.
- C.Permissions are attached to a role that describes a job function, and people are assigned to the role.✓ Answer
- D.Permissions are attached to the application owner, who then copies his own rights to each user.
Roles are defined before provisioning, and the role rather than the individual carries the permission set. Because the entitlements belong to the job function, everyone doing that job gets the same consistent access, and it can be granted, reviewed and revoked simply by adding or removing the role assignment.
Source: ISC2 CC Exam Outline, Identity and Access Management (IAM) Concepts — understand identity life cycle management, 'Roles definition'Report a problem with this question
2. New hires at a company receive accounts when a manager emails the help desk, and the access granted varies from hire to hire. Which change best corrects this?
- A.Create each account with broad access first and narrow it at the next scheduled review.
- B.Require managers to email a longer list naming every system the new hire will ever need.
- C.Keep the email process, but have a second manager approve each request by replying to it.
- D.Trigger account creation automatically from the approved new-hire record in the HR system.✓ Answer
Provisioning should be driven from an authoritative source of truth, normally the HR record, and automated through a workflow. Automation makes the granted entitlements identical for every person in the same role and leaves an audit trail, which an ad hoc ticket or email never guarantees.
Source: ISC2 CC Exam Outline, Identity and Access Management (IAM) Concepts — understand identity life cycle management, 'Provision'Report a problem with this question
3. Which sequence correctly orders the provisioning steps for a newly hired employee?
- A.Issue credentials, assign the role, verify the person's identity, then create the account.
- B.Create the account, issue credentials, verify the person's identity, then assign the role.
- C.Verify the person's identity, create the account, assign the role, then issue credentials.✓ Answer
- D.Assign the role, create the account, issue credentials, then verify the person's identity.
Identity proofing and enrollment come first: the organization confirms the person really is who they claim to be before any credential is bound to them. A credential issued before proofing would authenticate an unverified person, and role assignment must precede credential issuance so the account is never active with undefined access.
Source: ISC2 CC Exam Outline, Identity and Access Management (IAM) Concepts — understand identity life cycle management, 'Provision'Report a problem with this question
4. To save time, an administrator builds a new analyst's account by copying every group membership from a long-serving analyst. Why is this poor practice?
- A.The copy leaves the new account with no memberships at all until the directory replicates them.
- B.The copy carries privileges the veteran accumulated over years, far beyond the new hire's needs.✓ Answer
- C.The copy locks the veteran out of her own account until an administrator resets her password.
- D.The copy makes both people share one credential, so the logs cannot separate their actions.
Cloning an existing account imports that account's privilege creep along with its legitimate access, so the new hire starts out over-entitled and least privilege is broken on day one. Entitlements should instead be granted from the defined role for the job.
Source: ISC2 CC Exam Outline, Identity and Access Management (IAM) Concepts — 'Provision' and 'Principle of least privilege'Report a problem with this question
5. A newly hired systems administrator needs ordinary staff access from day one and will occasionally need domain administrator rights. What should provisioning grant at hire?
- A.Ordinary access plus the shared credential of the team's existing administrator account.
- B.Ordinary access plus standing administrative rights, since the job title already implies them.
- C.Administrative rights alone, because they already include every ordinary staff permission.
- D.Ordinary access for the role now, with administrative rights requested and approved separately.✓ Answer
Provisioning grants least privilege for the role as defined, and elevated rights are handled as a separate, approved request held in a distinct administrative account. Standing administrative rights on a daily-use account widen the blast radius of any phishing or malware hit on that session.
Source: ISC2 CC Exam Outline, Identity and Access Management (IAM) Concepts — 'Provision' and 'Principle of least privilege'Report a problem with this question
6. Three help desk technicians sign in to the ticketing system with a single shared 'support' account. What is the principal security problem?
- A.The shared password expires three times faster because three people keep signing in with it.
- B.The system refuses concurrent sessions, so two technicians wait while the third one works.
- C.Actions in the system cannot be traced to one person, so individual accountability is lost.✓ Answer
- D.The account cannot hold a role, so the technicians receive administrative rights instead.
Identity life cycle management requires a unique identity per person, because accountability and non-repudiation depend on being able to tie every logged action to one named human. A shared account also cannot be reviewed or revoked for one individual without disrupting the others.
Source: ISC2 CC Exam Outline, Identity and Access Management (IAM) Concepts — understand identity life cycle management, 'Provision'Report a problem with this question
7. Policy requires a network administrator to hold a daily-use account and a separate administrative account. What does this arrangement accomplish?
- A.The two accounts share one entitlement set, so a single review can cover both at once.
- B.The administrator appears by name in the logs, which one single account could not provide.
- C.The administrator changes a password only on the account that holds the elevated rights.
- D.Email and browsing run without elevated rights, so a compromise there does limited damage.✓ Answer
Separating privileged from routine work applies least privilege over time: the account exposed to email attachments, web content and everyday applications carries no administrative rights, so malware or a stolen session inherits only ordinary permissions. Elevated rights are used only in the separate account and only when needed.
Source: ISC2 CC Exam Outline, Identity and Access Management (IAM) Concepts — 'Principle of least privilege'Report a problem with this question
8. An employee is promoted from accounts payable clerk to finance supervisor. Which identity life cycle activity does this move primarily call for?
- A.A role definition exercise, because a supervisor's permission set cannot exist until now.
- B.A full deprovisioning, followed by fresh enrollment of the employee as a new identity.
- C.A review of her access, removing the old role's entitlements as the new ones are added.✓ Answer
- D.A provisioning step only, adding the supervisor entitlements on top of everything held.
A promotion or transfer is the 'mover' event, handled in the review stage of the life cycle. The prior role's entitlements must be removed at the same time the new ones are granted; layering new access on top of old is exactly how privilege creep accumulates.
Source: ISC2 CC Exam Outline, Identity and Access Management (IAM) Concepts — understand identity life cycle management, 'Review'Report a problem with this question
9. Which situation is the textbook description of privilege creep?
- A.An employee shares her password with a colleague, who then performs work under her name.
- B.An employee receives a permanent administrator account on day one because of her job title.
- C.An attacker exploits a flaw in a service to gain rights that its account was never assigned.
- D.An employee who transferred twice still holds the access granted in each earlier department.✓ Answer
Privilege creep is the gradual accumulation of entitlements as a person moves between roles, projects and departments without the old access ever being removed. It is a life cycle failure in the review stage, not an attack and not a provisioning decision.
Source: ISC2 CC Exam Outline, Identity and Access Management (IAM) Concepts — understand identity life cycle management, 'Review'Report a problem with this question
10. An audit finds that long-serving staff still hold entitlements from roles they left years ago. Which measure actually corrects this finding?
- A.Periodic access reviews in which each entitlement is confirmed, modified, or revoked.✓ Answer
- B.Multifactor authentication on every account, so stolen passwords cannot be reused.
- C.A shorter password expiry, forcing every member of staff to choose a new one monthly.
- D.Session timeouts that sign users out of applications after a period of inactivity.
Only review and removal fix privilege creep, because the entitlements themselves are the problem. Stronger authentication verifies who is signing in but does nothing about what that verified person is allowed to do once inside, so multifactor authentication and password rules leave the excess access untouched.
Source: ISC2 CC Exam Outline, Identity and Access Management (IAM) Concepts — understand identity life cycle management, 'Review'Report a problem with this question
11. During a user access review, who is best placed to judge whether an employee still needs a particular entitlement?
- A.The employee herself, who is closest to the work and knows what she opens daily.
- B.The help desk technician who originally created the account and granted the access.
- C.The data or system owner, or the employee's manager, who knows the business need.✓ Answer
- D.The internal auditor, whose independence lets her approve entitlements for the business.
Recertification decisions belong to whoever understands the business justification for the access, normally the data or system owner or the line manager. The help desk only executes changes, the auditor tests the control rather than owning it, and self-attestation by the user is a weak control because the user has an incentive to keep everything.
Source: ISC2 CC Exam Outline, Identity and Access Management (IAM) Concepts — understand identity life cycle management, 'Review'Report a problem with this question
12. Six months after a contractor's engagement ended, her domain account is still enabled and no manager or owner is recorded for it. How is this account best described, and why does it matter?
- A.Orphaned account; no owner remains to notice or challenge its continued use.✓ Answer
- B.Dormant account; it becomes harmless once its password passes the expiry date.
- C.Service account; an account with no named person is expected to persist this way.
- D.Privileged account; any account that outlives its owner is treated as administrative.
An orphaned account is an active account with no valid owner, typically left behind when a worker departs. It is dangerous precisely because nobody is watching it: credentials can be reused or guessed and the activity has no legitimate person to be compared against, so periodic audits must hunt these accounts down.
Source: ISC2 CC Exam Outline, Identity and Access Management (IAM) Concepts — understand identity life cycle management, 'Review' and 'Deprovision'Report a problem with this question
13. An employee resigns. Security wants her access stopped at once, while the legal team needs the contents of her mailbox available for a pending matter. What is the correct handling?
- A.Delete the account at once; the mail platform retains her mailbox separately anyway.
- B.Disable the account at once and delete it later under the data retention schedule.✓ Answer
- C.Leave the account enabled but change its password so investigators can sign in to it.
- D.Convert the account into a shared mailbox that her whole former team can sign in to.
Disabling stops authentication immediately while preserving the account object, and with it the audit trail, the mailbox and file ownership, and any encryption keys tied to the identity. Deletion destroys that evidence and can orphan encrypted data, so it is done only later, in line with the retention policy.
Source: ISC2 CC Exam Outline, Identity and Access Management (IAM) Concepts — understand identity life cycle management, 'Deprovision'Report a problem with this question
14. A manager will dismiss an employee in a meeting scheduled for 10:00. When should the employee's access be revoked?
- A.At the end of the business day, so that she can finish handing over her open files.
- B.At or just before the meeting starts, arranged in advance between HR and security.✓ Answer
- C.Within two weeks, once the next scheduled access review reaches her department.
- D.After the exit interview ends and she has returned her laptop and building badge.
For an involuntary termination the revocation is coordinated with HR and timed to the notification, because the window between learning of the dismissal and losing access is exactly when sabotage or data theft happens. A notice-period resignation can be handled on a gentler schedule, but a dismissal cannot.
Source: ISC2 CC Exam Outline, Identity and Access Management (IAM) Concepts — understand identity life cycle management, 'Deprovision'Report a problem with this question
15. A departing developer's directory account has been disabled on her last day. Which remaining step is most often missed and matters most?
- A.Revoking her API keys, personal access tokens and federated sessions in cloud services.✓ Answer
- B.Removing her entry from the printed staff directory so colleagues stop emailing her.
- C.Archiving her chat history so the team can still search past conversations later on.
- D.Deleting her workstation profile so the laptop can be reissued to another developer.
Deprovisioning must cover every path into the organization, not only the network logon. Tokens, API keys, certificates, VPN profiles, cloud and SaaS accounts and physical badges can all keep working after the directory account is disabled, and any shared or privileged credential the person knew should also be changed.
Source: ISC2 CC Exam Outline, Identity and Access Management (IAM) Concepts — understand identity life cycle management, 'Deprovision'Report a problem with this question
16. How does handling a hostile termination differ from handling an amicable resignation with a notice period?
- A.Access is cut only after the former employee has returned every item of equipment.
- B.Access is cut at the moment of notification instead of tapering across the notice period.✓ Answer
- C.Access is left in place longer so investigators can watch what the person does next.
- D.Access is treated identically, since the type of departure is an HR matter, not a security one.
Both departures end in full deprovisioning, but the timing differs with the risk. A cooperative leaver can retain limited access while handing over work, whereas a dismissal removes access at notification because a person who knows they are being let go has both motive and opportunity to damage or take data.
Source: ISC2 CC Exam Outline, Identity and Access Management (IAM) Concepts — understand identity life cycle management, 'Deprovision'Report a problem with this question
17. An organization deploys single sign-on across its business applications. Which description of the outcome is accurate?
- A.Users authenticate once for many applications, which makes that login a high-value target.✓ Answer
- B.Users keep one password per application, but every password now expires on one schedule.
- C.Users are automatically authorized for every application once any one of them admits them.
- D.Users authenticate twice per application, which is why the design also satisfies MFA policy.
Single sign-on lets a user authenticate once and reach many applications, which cuts password fatigue for the user and gives administrators one place to disable access on departure. The trade-off is concentration of risk: one compromised sign-on reaches everything, which is why SSO is paired with multifactor authentication. Authentication is still separate from authorization.
Source: ISC2 CC Exam Outline, Identity and Access Management (IAM) Concepts — understand identity life cycle management, 'Frameworks and tools'Report a problem with this question
18. A university lets researchers from partner institutions reach its shared library portal using credentials issued by their own institution. What is this arrangement called?
- A.Federation, in which trust between organizations carries identity across the boundary.✓ Answer
- B.Delegation, in which one user temporarily lends his account rights to a colleague.
- C.Provisioning, in which the portal creates its own local account for each researcher.
- D.Escalation, in which an existing session is granted a higher level of privilege.
Federation extends identity across organizational or trust boundaries: the home institution acts as identity provider and asserts who the researcher is, while the portal, as relying party, accepts that assertion instead of maintaining its own account for that person. This removes an entire provisioning and deprovisioning burden from the portal.
Source: ISC2 CC Exam Outline, Identity and Access Management (IAM) Concepts — understand identity life cycle management, 'Frameworks and tools'Report a problem with this question
19. An organization wants accounts in its cloud applications created, updated and removed automatically as staff join, move and leave. Which standard is designed for that?
- A.Kerberos, which issues tickets so a client can prove its identity to network services.
- B.SAML, which carries authentication assertions so a browser session can be trusted.
- C.LDAP, which is queried when an application looks up a user entry in the directory.
- D.SCIM, which carries identity records between systems so accounts stay synchronized.✓ Answer
SCIM is the provisioning standard: it moves user records between an identity source and target applications so joiner, mover and leaver changes propagate without manual work. SAML carries authentication assertions for single sign-on, which is a different job; a federated login can exist while the target application still has no account for the user.
Source: ISC2 CC Exam Outline, Identity and Access Management (IAM) Concepts — understand identity life cycle management, 'Frameworks and tools'Report a problem with this question
20. A firm wants administrative credentials held in a vault, checked out only when needed, and every administrative session recorded. Which category of tooling provides this?
- A.Identity governance, which runs the campaigns that recertify ordinary user entitlements.
- B.Privileged access management, which vaults admin credentials and time-limits their use.✓ Answer
- C.Directory services, which store the user objects and group memberships of an organization.
- D.Single sign-on, which passes one authenticated session to many downstream applications.
Privileged access management exists for the accounts that can do the most damage: it vaults their credentials, issues them just in time for a bounded window, and records the session so the activity can be reviewed. Because these accounts carry the highest risk, they are also recertified more often than ordinary user accounts.
Source: ISC2 CC Exam Outline, Identity and Access Management (IAM) Concepts — understand identity life cycle management, 'Frameworks and tools'Report a problem with this question
21. Which function best describes identity governance and administration tooling?
- A.It automates access requests, joiner-mover-leaver workflows and certification campaigns.✓ Answer
- B.It inspects packets at the network edge and drops traffic that violates a defined rule set.
- C.It stores reversible copies of user passwords so the help desk can recover them on request.
- D.It records keystrokes in administrator sessions so investigators can replay the commands.
Identity governance and administration is the policy and workflow layer over the life cycle: it handles role mining and definition, access request and approval, joiner-mover-leaver automation, and the recertification campaigns that surface privilege creep and orphaned accounts. Packet inspection and session recording belong to other control categories.
Source: ISC2 CC Exam Outline, Identity and Access Management (IAM) Concepts — understand identity life cycle management, 'Frameworks and tools'Report a problem with this question
22. A data science project has ended, but the automation account its AI agent used to read production databases is still enabled with the same permissions. What does identity life cycle management require?
- A.Rename the account but leave it enabled, so a later project can reuse its permissions.
- B.Deprovision the automation account when the project retires, as for a departing employee.✓ Answer
- C.Keep the account active, because non-human identities sit outside access review programmes.
- D.Hand the account's credential to the platform team, so ownership passes to that group.
Service accounts, bots and AI agents go through the same life cycle as people: a defined role, provisioning with a unique identity and a named human owner, inclusion in access reviews, and deprovisioning when the workload retires. Left enabled, such an account is an orphaned identity with standing access to production and no one watching it.
Source: ISC2 CC Exam Outline, Identity and Access Management (IAM) Concepts — understand identity life cycle management, applied to non-human (service and AI) identitiesReport a problem with this question
Practice questions based on the ISC2 Certified in Cybersecurity (CC) Exam Outline. This site is not affiliated with or endorsed by ISC2, and these are not real exam questions. ISC2 revises the domains and their weights periodically and sets the exam length, passing standard and eligibility terms — confirm the current outline and requirements with ISC2 before you register. Official CC exam outline →