ISA 4.0 Module 4 – Topic Wise

Module 4: Identity Management & Access Controls (IAM) Enterprise IAM, Zero Trust Identity, Privileged Access Management (PAM) & Cloud Access Governance Course Overview & Scope: Identity is the new security perimeter. This course is the most comprehensive quiz collection in the curriculum, comprising 1,470 practice questions covering the complete spectrum of Identity and Access Management (IAM). Auditors learn to evaluate Identity Governance and Administration (IGA), automated provisioning/deprovisioning (Joiner-Mover-Leaver cycles), multi-factor authentication (MFA), passwordless schemes, biometrics, Single Sign-On (SSO), federation, Directory Services (Active Directory, Azure AD/Entra ID), Privileged Access Management (PAM), session monitoring, vaulting, break-glass procedures, Segregation of Duties (SoD), and Zero Trust Architecture. Key Regulatory Frameworks & Standards Covered: ISO/IEC 27002:2022 (Access Control), NIST SP 800-63 (Digital Identity Guidelines), CIS Controls v8, GDPR/DPDP Access Security. Core Audit Competencies Tested in Quizzes:

• Auditing enterprise Identity Governance and Administration (IGA) processes and role-engineering models.
• Testing Multi-Factor Authentication (MFA), FIDO2 tokens, biometric enrollment, and false acceptance/rejection metrics.
• Evaluating Privileged Access Management (PAM), vaulting, password rotation, and just-in-time (JIT) access.
• Performing Active Directory / Azure AD (Entra ID) configuration and group membership security reviews.
• Executing automated Joiner-Mover-Leaver (JML) reconciliations against HR databases and Active Directory logs.

Detailed Topic-Wise Active Quiz Index (Module 4)

Chapter / Section	Topic Quiz Title	Qs
Chapter 1: Introduction to Identity Management & Access Controls	Identity and Access Management	79
	Logical Access Controls	21
	Logical Access Controls – Introduction	31
	Objective of Logical Access Controls	10
	Concepts of IS Audit – Learning Objectives	1
Chapter 2: Scope & Approach of an IAM Audit	Auditing Logical Access Controls	40
	Paths of Logical Access Controls	10
	Information Security Policies, Procedures, Standards and Guidelines	24
	COBIT 2019 Framework: principles, components and core models	17
Chapter 3: Standards, Frameworks & Regulatory Drivers	Logical Access Policy & Procedures	25
	Logical Access Attacks and Exposures	89
	Processes	5
	Role of IS Auditor in Information Risk Management	4
Chapter 4: Identity Governance & Administration (IGA)	Logical Access Controls – User Management	2
	Default Users Management	1
	User Access Rights Management	1
	Access Control Mechanisms	66
Chapter 5: Authentication & Credential Management	Authentication Techniques	63
	Passwords and PINs	3
	One-Time Passwords	4
	Token Based Authentication	8
	Biometric Authentication	2
	Biometric Authentication – Biometric	56
	Biometric Authentication – Equal-Error Rate.	5
	Biometric Authentication – False Acceptance Rate	11
	Biometric Authentication – Iris Scan	2
Chapter 6: Authorization & Access Enforcement	Authorization Techniques Operating System	57
	Access Control Mechanisms	66
	Logical Access Control Techniques	53
Chapter 7: Privileged Access Management (PAM)	Privilege User Management	1
	Password Management	3
	Logical Access Controls	21
	Human Resource Security	1
Chapter 8: Directory Services & Identity Repositories	Database Access Controls	11
	Operating System Access Controls	12
	Audit Trails	64
Chapter 9: Cloud Identity & Access Management	Cloud Computing Architecture, Environment and Service Model	80
	Security Frameworks in Cloud	17
	Logical Access Control Techniques	53
Chapter 10: Access Certification & Recertification	User Access Rights Management	1
	Logical Access Controls – User Management	2
	Other Common Security Policies	8
Chapter 11: Segregation of Duties (SoD) & Sensitive Access	Software Testing and Implementation – Segregation of Duties	1
	Logical Access Controls – User Management	2
	Administrative Controls of Information Assets – Segregation of Duties	14
	Audit planning	36
Chapter 12: Identity Lifecycle Management (JML)	Logical Access Controls – User Management	2
	User Access Rights Management	1
	Privilege User Management	1
	Risk Assessment	31
Chapter 13: Monitoring, Logging & Audit Trails	Audit Trails	64
	Introduction to Protection of Information Assets	22
	Types of Controls	42
Chapter 14: Emerging Trends in IAM	Single Sign on	47
	Remote Access Controls	19
	Logical Access Control Techniques	53
	Audit Documentation	3
Chapter 15: Practical Audit Execution & Test Procedures	Auditing Logical Access Controls	40
	Access Controls in Operating Systems	53
	Key Man Policy	1
	Token Based Authentication	8
	TOTAL ACTIVE QUESTIONS IN MODULE 4:	1,470