Identity and Access Management

Which authentication factor type is a smart card?

In Kerberos authentication, which component issues a Ticket Granting Ticket (TGT) after verifying the user's credentials?

An attacker who has compromised the Kerberos Key Distribution Center (KDC) could forge a Ticket Granting Ticket (TGT) to impersonate any user. This type of attack is known as:

Which OAuth 2.0 grant type is recommended for a public client (e.g., single-page application) that cannot securely store a client secret?

OpenID Connect (OIDC) extends OAuth 2.0 primarily by adding which capability?

An organization is implementing identity management and wants to ensure that when an employee leaves, all access is promptly revoked. Which process is most directly responsible for removing accounts and access rights for a leaver?

A security analyst is reviewing access rights and discovers an active account belonging to a former employee who left six months ago. This is an example of:

In a Privileged Access Management (PAM) solution, which feature provides temporary elevation of privileges for specific tasks, reducing the risk of standing privileges?

In LDAP, what does the Distinguished Name (DN) uniquely identify?

Which access control model allows the owner of a resource to determine who can access it and what permissions they have?

A security policy requires that a user cannot have both the ability to create purchase orders and approve invoices. This is an example of:

Which of the following is an example of a Type 2 authentication factor?

A security administrator is configuring a system that requires users to provide a password and a one-time code from a hardware token. Which authentication method is being implemented?

Which protocol is specifically designed for authorization and not authentication, often using grant types like authorization code and client credentials?

In an OAuth 2.0 authorization code flow with PKCE, what is the primary purpose of the code verifier and code challenge?

An organization wants to implement single sign-on across multiple web applications using an XML-based protocol that supports identity provider (IdP) and service provider (SP) initiated flows. Which technology should they choose?

An employee leaves the company, and their user account is not disabled. This creates a security risk known as:

Which principle ensures that a user is granted only the permissions necessary to perform their job functions?

An organization wants to provide just-in-time administrative access to servers, with session recording and password vaulting. Which solution is best suited?

An LDAP distinguished name (DN) includes the attribute 'CN=John Doe,OU=Sales,DC=company,DC=com'. What does 'CN' stand for?

Which access control model bases decisions on attributes of the user, resource, and environment, and can use Boolean logic to define policies?

A security analyst is reviewing access controls for a financial application. Which TWO of the following are considered best practices for preventing fraud? (Select TWO.)

An organization is implementing a Privileged Access Management (PAM) solution. Which THREE of the following are common features of PAM? (Select THREE.)

Which of the following is an example of a Type 1 authentication factor?

In Kerberos authentication, what is the purpose of the Ticket Granting Ticket (TGT)?

A security analyst discovers that an attacker has gained domain admin privileges by forging a Kerberos TGT using the KRBTGT account hash. Which attack has occurred?

In SAML 2.0, which component is responsible for authenticating the user and generating an assertion?

An organization wants to enable single sign-on (SSO) across multiple web applications using an XML-based protocol that supports browser redirect flows. Which technology is most appropriate?

In OAuth 2.0, which grant type is recommended for a native mobile application that cannot securely store a client secret, and uses PKCE?

Which of the following is a process that ensures users periodically confirm they still need access to systems and data?

A financial application requires two employees to authorize a wire transfer. Which principle does this implement?

An organization implements Privileged Access Management (PAM) and wants to reduce the risk of standing privileges. Which approach grants temporary elevated access only when needed?

In LDAP, which attribute uniquely identifies an entry within the directory information tree?

Which access control model assigns permissions based on a user's job function?

A security administrator is reviewing potential risks associated with orphaned accounts. Which TWO of the following are risks of orphaned accounts?

Which THREE of the following are components of a Privileged Access Management (PAM) solution?

Which TWO of the following are differences between OAuth 2.0 and OpenID Connect (OIDC)?

A security architect is designing an authentication system for a healthcare application that requires strong security. The system will use a password and a one-time passcode sent via SMS. How many authentication factor types are being used?

During a Kerberos authentication process, the client receives a Ticket Granting Ticket (TGT) from the Authentication Server (AS). Later, the client presents the TGT to the Ticket Granting Server (TGS) to request a service ticket. Which of the following best describes the purpose of the TGT?

An organization implements Single Sign-On (SSO) using SAML 2.0. A user attempts to access a cloud application (Service Provider) but is not authenticated. The Service Provider redirects the user to the Identity Provider (IdP) for authentication. Which type of SAML flow is this?

A developer is implementing OAuth 2.0 for a mobile app (public client) that needs to access a user's data from a third-party API. To mitigate the authorization code interception attack, which OAuth 2.0 extension should be used?

A financial institution requires that no single employee can approve a transaction and also reconcile the account. This is an example of which security principle?

Which of the following is a lightweight directory access protocol used for accessing and maintaining distributed directory information?

An organization discovers that a former employee's account is still active and has been used to access sensitive data. This is an example of which type of risk?

Which TWO of the following are characteristics of a Privileged Access Management (PAM) solution? (Choose two.)

Which TWO of the following are OAuth 2.0 grant types? (Choose two.)

A security analyst is performing an access review. Which THREE of the following are best practices for user access recertification? (Choose three.)

In the context of identity management, which TWO of the following are risks associated with orphaned accounts? (Choose two.)

An organization is implementing OpenID Connect (OIDC) for authentication. Which THREE of the following are components of OIDC? (Choose three.)

Which TWO of the following are examples of Type 3 authentication factors? (Choose two.)

A healthcare organization uses a federated identity provider (IdP) to authenticate clinicians into a third-party electronic health record (EHR) application acting as a SAML 2.0 Service Provider (SP). The security team wants to reduce the risk that a stolen IdP session cookie could be replayed against the EHR. Which SAML 2.0 control should the team implement to bind the assertion to the authenticated browser session and limit replay?

A multinational bank must enforce least privilege across 4,000 roles that change frequently as employees move between trading, compliance, and IT functions. Auditors found that access reviews are performed manually and that role definitions drift from actual job duties. The identity team proposes a role mining and management program. Which approach best aligns with identity and access management governance objectives while reducing role explosion?

A financial services firm is deploying a customer-facing mobile banking app and wants to delegate limited access to account balances and transaction history to third-party budgeting apps without sharing the customer's banking credentials. The security architect must select controls that implement this delegation securely. (Choose two.)