Cataloging applications, systems, and user roles is part of which IAM activity?

• A. Risk-Based Approach.
• B. Access Log Monitoring.
• C. IAM Risk Management.
• D. Program Delivery Objectives.

Answer: (A)

Cataloging what exists and who has access is the foundation for prioritizing protections. In a risk-based approach to IAM, you first build an inventory of applications, systems, and user roles so you can see where sensitive data and critical processes reside and who can reach them. That inventory lets you assess potential impacts and likelihoods, assign risk levels, and then tailor controls to the highest-risk areas, rather than applying generic safeguards everywhere. Access log monitoring, by contrast, focuses on observing events after they happen, and IAM risk management is the broader discipline that includes governance and risk processes, not the initial inventory step. Program delivery objectives don’t address the risk-informed protection of identities and resources.