What is a best practice for testing IAM controls?

• A. Review password policies
• B. Review access requests, logs, roles, least privilege adherence, and recertifications
• C. Ignore privileged accounts
• D. Focus solely on onboarding

Answer: (B)

Evaluating IAM controls effectively hinges on end-to-end visibility into who has access, why, and how that access is governed over time. A best practice is to review access requests and the corresponding approvals, examine the provisioning events and logs, analyze the defined roles, verify that access aligns with the principle of least privilege, and confirm that regular recertifications are performed. This approach ensures that what was requested and granted matches actual needs, that privileged and general access are monitored, and that any drift is caught through ongoing reviews. Relying only on password policies tests a single control and does not prove ongoing access governance. Ignoring privileged accounts leaves critical risk unaddressed, and focusing solely on onboarding misses the important lifecycle steps of provisioning, monitoring, and deprovisioning that keep IAM controls effective over time.