Which activity best exemplifies a risk-based IAM program start?

Which activity best exemplifies a risk-based IAM program start?

• A. Risk-Based Approach.
• B. Catalog applications, systems, and user roles.
• C. Test solutions with real users before deployment.
• D. Analyze logs for suspicious activities.

Answer: (B)

Starting with a clear inventory of what exists is essential in a risk-based IAM program. Cataloging applications, systems, and the user roles that interact with them provides the foundation you need to understand risk. When you know what assets exist, where sensitive data resides, and who has access to what, you can prioritize protections, design appropriate access controls, and establish least-privilege and separation of duties effectively. This concrete snapshot lets you map risks to specific assets and roles, making it possible to focus mitigations where they matter most. The other activities are important in their own right—employing a risk-based approach guides how you prioritize work; testing solutions with real users helps validate usability and effectiveness before full deployment; and analyzing logs for suspicious activities supports ongoing monitoring. But without first cataloging assets and roles, you don’t have a solid, scoped basis to apply risk-based controls or to prioritize actions.

Starting with a clear inventory of what exists is essential in a risk-based IAM program. Cataloging applications, systems, and the user roles that interact with them provides the foundation you need to understand risk. When you know what assets exist, where sensitive data resides, and who has access to what, you can prioritize protections, design appropriate access controls, and establish least-privilege and separation of duties effectively. This concrete snapshot lets you map risks to specific assets and roles, making it possible to focus mitigations where they matter most.

The other activities are important in their own right—employing a risk-based approach guides how you prioritize work; testing solutions with real users helps validate usability and effectiveness before full deployment; and analyzing logs for suspicious activities supports ongoing monitoring. But without first cataloging assets and roles, you don’t have a solid, scoped basis to apply risk-based controls or to prioritize actions.