What are key IAM controls, and how can an internal auditor test them?

• A. Password complexity only
• B. Physical access controls
• C. None
• D. User provisioning/deprovisioning, privileged access management, MFA, SSO, access reviews; test by reviewing access requests, logs, roles, least privilege adherence, and conducting sample access recertifications.

Answer: (D)