SY0-701 Question 349
Single answerIdentity proofingA healthcare organization is onboarding remote contractors who need access to systems containing regulated patient data. The security team has discovered that several accounts were issued based only on emailed copies of driver's licenses, and one account was later linked to a stolen identity. Leadership wants to reduce the risk of issuing accounts to impostors before credentials are created. Which action would BEST improve the organization's identity proofing process for these remote users?
- A
Require a live remote identity verification process that validates a government-issued ID and compares it to a real-time selfie or video before the account is issued
- B
Require contractors to change their passwords every 30 days after receiving their initial credentials
- C
Enable single sign-on (SSO) so contractors use one account for all approved applications
- D
Send a one-time password (OTP) to the contractor's email address before the first login
Show answer and explanation
Correct answer: A
Explanation
The best answer is the live remote identity verification process because identity proofing occurs before credentials are issued and is intended to establish confidence that the subject is the claimed person. In this scenario, the core failure is weak enrollment based solely on emailed document images, which are easy to forge, steal, or reuse. Stronger proofing should include validation of identity evidence and verification that the applicant presenting the evidence is the same person shown on it. This aligns with widely used digital identity guidance such as NIST SP 800-63A, which discusses identity proofing and enrollment concepts including evidence validation and binding the applicant to the claimed identity. The other options are useful in other parts of an IAM program, but they do not solve the specific problem of preventing fraudulent account issuance during onboarding.
- A. Correct.
Correct. Identity proofing is the process of verifying that a claimed identity belongs to the actual person before granting access or issuing credentials. A live remote verification workflow that checks the authenticity of a government ID and matches it to the applicant through a selfie or video step directly addresses the organization's problem: fraudulent enrollment using stolen or fake identity documents. This is a practical remote equivalent of in-person proofing and aligns with common digital identity proofing practices, including evidence validation and biometric or visual comparison during enrollment.
- B. Incorrect.
Incorrect. Password rotation is an authentication and account management control, not an identity proofing control. It may affect post-enrollment credential hygiene, but it does not verify that the person receiving the account is who they claim to be. Someone might choose this option because it sounds security-focused, but it addresses credential lifecycle management rather than pre-issuance identity verification.
- C. Incorrect.
Incorrect. SSO improves usability and can centralize authentication, but it does not establish whether the initial identity is legitimate. If an impostor is issued an account, SSO can actually extend that bad identity across multiple systems. This option is a plausible distractor because SSO is often part of identity and access management, but it is not an identity proofing mechanism.
- D. Incorrect.
Incorrect. Sending an OTP to the contractor's email verifies control of that email account at that moment, not the person's real-world identity. If the email account was fraudulently created or compromised, the impostor could still complete enrollment. Candidates may pick this because OTPs are associated with verification, but this is account possession verification, not strong identity proofing.