Identity And Access Management (IAM) Concepts practice questions

The Joiner-Mover-Leaver model maps organizational events to identity life cycle activities: joiners are provisioned, movers have access adjusted and reviewed, and leavers are deprovisioned.

When a person joins the organization, the identity system must create their unique account and grant the access their defined role requires. That granting activity is provisioning, so Joiner maps directly to provisioning.

1. Identify the JML event: a Joiner is a person newly entering the organization.
2. Match the event to the life cycle: entry requires creating an account, which is provisioning.
3. Apply least privilege at that moment: grant only the access the person's role was defined to need.
4. Contrast with the other events: Movers trigger access adjustment and review, Leavers trigger deprovisioning.

Exam tip: Joiner means provision, Mover means adjust and review, Leaver means deprovision.

Provisioning is the life cycle phase in which a user account is created and granted the specific access defined for the user's role.

The defining feature of provisioning is granting access: the account is created and receives exactly the entitlements the roles definition phase said the job requires. Options describing removal, review, or data backup describe other phases of the life cycle.

1. Start from the roles definition: the access a role needs has already been decided.
2. Create a unique account for the new user so their actions remain attributable.
3. Grant only the entitlements defined for the role, applying least privilege from day one.
4. Hand the account over to the review phase, which will later confirm the access is still needed.

Exam tip: Provisioning grants access; it should grant only what the defined role requires and nothing extra.

Accountability requires that every action in a system be traceable to a single individual, which is only possible when each user has a unique account.

Audit logs record which account performed an action. If an account is shared by several people, the log cannot identify which person acted, so accountability is destroyed. Issuing a unique account to every user keeps every logged action attributable to exactly one individual.

1. Recognize that audit trails record account identifiers, not the human at the keyboard.
2. Note that a shared account maps many people to one identifier, so no single person can be held responsible.
3. Issue a unique account per user so each log entry points to exactly one individual.
4. Prohibit shared accounts as policy, because they destroy accountability even when convenient.

Exam tip: One person, one account: unique accounts exist to preserve accountability, and shared accounts destroy it.

Privilege creep is the gradual, unintended accumulation of access rights as a user moves between roles without their old access being removed.

The defining elements are gradual accumulation and role change: each move adds new entitlements while previous ones are never revoked, so the user ends up with far more access than their current job requires. This is the classic Mover risk in the JML model.

1. A user is provisioned with least privilege for their first role.
2. The user transfers to a new role and receives the new role's access, but the old access is not removed.
3. Over several moves the account accumulates entitlements no single role would justify.
4. Periodic access reviews detect and strip the excess, restoring least privilege.

Exam tip: Privilege creep is the Mover risk: access accumulates across role changes until a review strips what is no longer needed.

An orphaned account is an active account whose owner has separated from the organization, created when deprovisioning fails to happen.

The two defining traits are that the account still works and that no current employee owns it. Because nobody is using or monitoring it legitimately, an attacker who compromises it can operate with little chance of the real owner noticing, which makes orphaned accounts prime attacker targets.

1. A person leaves the organization, which should trigger the Leaver deprovisioning step.
2. Deprovisioning is missed or delayed, so the account remains active with all its access.
3. The account now has no legitimate user to notice suspicious activity on it.
4. Attackers seek out such accounts because compromise is unlikely to be reported; prompt deprovisioning and automated IAM workflows prevent them.

Exam tip: An orphaned account is live access with no living owner, and it is one of the most attractive targets an attacker can find.

Deprovisioning is the life cycle phase that removes access when a user leaves, closing out the Leaver event in the JML model.

Separation means the person no longer has any business need for access, so every entitlement must be removed promptly. The phase dedicated to that removal is deprovisioning; the other phases define, grant, or check access rather than ending it.

1. The separation event, voluntary or involuntary, triggers the Leaver workflow.
2. The account is disabled promptly so it can no longer be used to log in.
3. Audit data and account records are preserved according to the retention policy.
4. The account is deleted later, once retention requirements allow, completing deprovisioning.

Exam tip: Deprovisioning ends the life cycle: when a person leaves, their access must be removed promptly.