Access certification is the name of the process that tries to remove the excess privilege that an employee may have after receiving a promotion. Access certification is a process that involves reviewing and verifying the access rights and the privileges that are assigned to the users, and ensuring that they are appropriate and necessary for their roles and responsibilities. Access certification can help prevent or reduce the risk of unauthorized or excessive access, and improve the security and the compliance of the organization's information systems and assets. Access certification is especially important when an employee receives a promotion, as they may have access to higher-level functions on the system, as well as keeping their access to the previous system that is no longer needed or applicable. This may create a situation where the employee has more access than they need, which may violate the principle of least privilege, or the segregation of duties. Therefore, access certification is the name of the process that tries to remove the excess privilege that an employee may have after receiving a promotion, by reviewing and updating their access rights and privileges, and by revoking or modifying the access that is no longer required or appropriate.

The Capability Maturity Model Integration (CMMI) is a framework that defines the best practices and standards for improving the performance, quality, and efficiency of an organization's processes. The CMMI consists of five maturity levels that represent the degree of maturity and capability of the organization's processes, from level 1 (lowest) to level 5 (highest). Each maturity level consists of several process areas that define the specific goals and practices for the organization's processes. The maturity level that is identified by a managed process that is tailored from the organization's set of standard processes according to the organization's tailoring guidelines is level 3: Defined. A managed process is a process that is planned, executed, monitored, and controlled, and that meets the requirements and objectives of the organization and the stakeholders. A set of standard processes is a collection of processes that are established and maintained by the organization, and that can be applied to different projects or situations. A tailoring guideline is a rule or criterion that defines how the standard processes can be adapted or modified to suit the specific needs or characteristics of a project or situation. Level
3: Defined means that the organization has a well-defined and consistent process that is based on the standard processes, but that can be tailored to meet the specific requirements and objectives of each project or situation. Level 3: Defined can help to improve the effectiveness, predictability, and repeatability of the organization's processes, as well as to enable the continuous improvement of the processes. Level 0: Incomplete, level 1: Performed, or level 2:
Managed are not the maturity levels that are identified by a managed process that is tailored from the organization's set of standard processes according to the organization's tailoring guidelines, as they are either lower or non-existent levels of maturity and capability of the organization's processes.

A directory service can be deployed via a cloud service or on-premises to integrate with Identity as a Service (IDaaS) as the authoritative source of user identities. A directory service is a software application that stores and organizes information about the users, devices, and resources in a network. A directory service provides a centralized and standardized way to manage and access the information, and to perform identity and access management functions, such as authentication, authorization, and auditing. A directory service uses a hierarchical or tree- like structure to organize the information into logical units, such as domains, organizational units, or groups. A directory service also uses a schema to define the attributes and rules for the information, such as the name, password, or role of a user. A directory service can be deployed via a cloud service or on-premises, depending on the needs and preferences of the organization.
A cloud-based directory service is a directory service that is hosted and managed by a cloud service provider, such as Azure Active Directory or Google Cloud Directory. A cloud-based directory service can offer the advantages of scalability, availability, and cost-effectiveness, but may also pose the challenges of security, privacy, and compliance. An on-premises directory service is a directory service that is installed and managed by the organization itself, such as Microsoft Active Directory or OpenLDAP. An on-premises directory service can offer the advantages of control, customization, and integration, but may also pose the challenges of maintenance, performance, and reliability. A directory service can be integrated with IDaaS as the authoritative source of user identities. IDaaS is a cloud-based service that provides identity and access management capabilities, such as single sign-on, multi-factor authentication, or identity federation, to the users and applications of an organization. IDaaS can leverage the existing user information and credentials from the directory service, and synchronize and authenticate them across different systems and platforms. IDaaS can also provide additional features and functions that the directory service may not support, such as self-service, password management, or identity governance.

The correct list of password attacks is brute force, dictionary, phishing, and keylogger. Password attacks are the attacks that aim to guess, crack, or steal the passwords or the credentials of the users or the systems, and to gain unauthorized or malicious access to the information or the resources.
Password attacks can include the following methods:
- Brute force is a method that tries all possible combinations of characters or symbols until the correct password is found.
- Dictionary is a method that uses a list of common or likely words or phrases as the input for guessing the password.
- Phishing is a method that uses fraudulent emails or websites that impersonate legitimate entities or parties, and that trick the users into revealing their passwords or credentials.
- Keylogger is a method that uses a software or a hardware device that records the keystrokes of the users, and that captures or transmits their passwords or credentials.
Masquerading, salami, malware, and polymorphism are not password attacks, as they are related to the impersonation, manipulation, infection, or mutation of the data or the systems, not the guessing, cracking, or stealing of the passwords or the credentials. Zeus, netbus, rabbit, and turtle are not password attacks, as they are the names of specific types of malware, such as trojans, worms, or viruses, not the methods of attacking the passwords or the credentials. Token, biometrics, IDS, and DLP are not password attacks, as they are the types of security controls or technologies, such as authentication, identification, detection, or prevention, not the attacks on the passwords or the credentials.