Which capability is NOT typically provided by an IAM system?

• A. Authentication
• B. Authorization
• C. Data backup
• D. User provisioning

Answer: (C)

The function being tested is what an IAM system primarily does: manage identity and access. An IAM system verifies who a user is (authentication), determines what that user is allowed to do (authorization), and handles the lifecycle of user accounts (provisioning, deprovisioning, role assignments). Data backup, on the other hand, is about creating and protecting copies of data so it can be recovered after loss or corruption. That is the domain of backup and disaster recovery tools, storage solutions, and data governance processes, not of identity and access management. So data backup is not typically provided by an IAM system, making it the correct choice.