CISSP - Identity and Access Management (IAM) (13% of the exam) - Section 5.5

Manage the identity and access provisioning lifecycle including provisioning, access review, role definition, and privilege escalation handling.

Manage the identity and access provisioning lifecycle by applying consistent procedures for account provisioning, periodic access review, deprovisioning, and handling privilege escalation requests. Recognise how orphaned accounts and unreviewed service accounts create residual access risks and describe the controls that mitigate them.

account provisioningaccess reviewdeprovisioningprivilege escalationservice accounts

Practice question for this objective

Free sampleIdentity and Access Management (IAM)medium

A risk manager is reviewing a proposed federation in which a global supplier will act as identity provider for staff signing into the organisation's procurement portal. Which residual risk is MOST important to address through contractual and technical controls because it cannot be removed simply by adopting a federation protocol?

AThe choice of SAML over OpenID Connect introduces XML signature wrapping vulnerabilities that cannot be mitigated by any relying party configuration.
BThe federation will introduce a circular trust between the identity provider and the resource server that prevents revocation of access tokens once issued.
CAdopting a federation protocol forces the relying party to accept the identity provider's encryption ciphers for data at rest within the procurement portal.
DThe relying party must accept the identity provider's account lifecycle and authentication assurance, so a weak joiner-mover-leaver process at the supplier directly affects portal access. Correct

Recognise that federating identity transfers account lifecycle and authentication assurance risk to the identity provider, requiring contractual and technical controls. When an organisation accepts assertions from a third-party identity provider, the strength of authentication, the joiner-mover-leaver process, and the timeliness of revocation all become someone else's operational responsibility. The relying party still bears the business consequences of unauthorised access. CISSP-level risk management therefore focuses on contractual obligations covering assurance level, incident notification, and offboarding service levels, complemented by technical controls such as short session lifetimes, attribute-based authorisation, and back-channel or front-channel logout. Protocol choice alone does not address this transferred risk.

Why A is wrong: XML signature wrapping is a real implementation risk with SAML, but it can be mitigated by hardened parsers, strict schema validation, and library updates. It is not the dominant residual risk in this scenario.

Why B is wrong: Federation does not create circular trust between identity provider and resource server. Token revocation is a real challenge for bearer tokens, but it can be addressed with short lifetimes and introspection, and it is not unique to this federation.

Why C is wrong: Federation governs authentication and assertions, not data-at-rest encryption in the relying party. The relying party retains control of its own storage cryptography, so this is not a residual federation risk.

Why D is correct: Federation moves authentication and the account lifecycle to the identity provider, so the relying party inherits whatever assurance and offboarding rigour the supplier applies. Contractual obligations and technical signals such as session timeouts and back-channel logout are required to manage this transferred risk.

See more CISSP practice questions, answers explained.

Exam traps in Identity and Access Management (IAM)

Answers that look right on this material and are not. Each one is a distractor from a different question in the CISSP bank for this domain.

A preventive function, because reviewing the logs each week stops unauthorised individuals from entering the records room in the first place.
Why it is wrong: Log review happens after entries have already occurred, so it cannot prevent the entry itself. Prevention would require a barrier or authorisation check at the door rather than periodic review afterwards.
Automatically revoke any entitlement showing no usage in the last 180 days and notify the affected users after the fact.
Why it is wrong: Bulk automated revocation without manager engagement is tempting because it shrinks entitlements quickly, but it risks breaking legitimate periodic activities such as quarter-end or annual processing and undermines the manager-owned review model the bank already relies on.
The developer exercised access she no longer needed, which constitutes a violation of the acceptable use policy.
Why it is wrong: Framing this as user misconduct is tempting because the developer did act outside her current remit, but it deflects from the systemic gap. Policy enforcement on individuals cannot substitute for a provisioning lifecycle that removes access when roles change.

Examworthy is not affiliated with or endorsed by ISC2. Original, blueprint-aligned practice material only.