CISSP Identity and Access Management — 15 Questions

Question 1

Which statement about SAML 2.0 is correct?

Accepted Answer

SAML relies on browser redirects for SSO flows.. SAML 2.0 (specifically the Web Browser SSO Profile) relies on the user's browser to redirect the user-agent between the Service Provider (SP) and the Identity Provider (IdP) using bindings such as HTTP Redirect or HTTP POST. SAML uses XML (not JSON) for its assertions, supports both IdP-initiated and SP-initiated SSO flows, and is primarily designed for federated authentication (identity assertion) rather than fine-grained authorization.

Answer

SAML supports only IdP-initiated SSO.

Answer

SAML uses JSON for its assertions.

Answer

SAML is primarily used for authorization, not authentication.

Question 2

An organization is implementing Privileged Access Management (PAM). Which THREE of the following are common features of a PAM solution? (Select THREE)

Accepted Answer

Password vaulting. Common PAM features include password vaulting, just-in-time (JIT) access, and session recording/monitoring. Single Sign-On (SSO) and self-service password reset (SSPR) are general Identity and Access Management (IAM) features rather than core Privileged Access Management (PAM) capabilities.

Answer

Self-service password reset

Answer

Break-glass access

Question 3

A company implements a policy requiring two different employees to approve a payment transaction. This is an example of:

Accepted Answer

Dual control. Separation of duties (SoD) prevents fraud by ensuring that a single person cannot initiate and complete a critical transaction alone. By requiring one employee to initiate the payment and another to approve it, the process is split, mitigating the risk of collusion and unauthorized transactions.

Answer

Need-to-know

Answer

Least privilege

Answer

Two-person control

Question 4

An organization uses Active Directory and needs to enforce password complexity settings for all users in a specific department. What is the most efficient way to achieve this?

Accepted Answer

Use a script to set passwords for each user. In Active Directory, standard domain password policies can only be set at the domain level (typically via the Default Domain Policy). Linking a GPO to an OU to change password settings for domain users in that OU does not work; it only affects local accounts on the computers inside that OU. To enforce different password complexity settings for a specific department, you must use Fine-Grained Password Policies (FGPP) by creating a Password Settings Object (PSO) and applying it to a global security group containing the department's users.

Answer

Configure password settings in the user's individual properties

Answer

Apply a Group Policy Object (GPO) to the OU containing the department's users

Answer

Create a password policy in the Default Domain Policy

Question 5

Which of the following access control models allows the data owner to decide who can access their resources?

Accepted Answer

Discretionary Access Control (DAC). Discretionary Access Control (DAC) is the correct answer because it allows the data owner (the creator or custodian of the resource) to decide who can access their resources and at what privilege level. In DAC, access rights are assigned based on the owner's discretion, typically using Access Control Lists (ACLs) or owner-based permissions, as seen in file systems like NTFS or UNIX chmod.

Answer

Attribute-Based Access Control (ABAC)

Answer

Mandatory Access Control (MAC)

Answer

Role-Based Access Control (RBAC)

Question 6

Which authentication factor type is a smart card?

Accepted Answer

Type 2 (something you have). A smart card is a Type 2 authentication factor because it falls under the 'something you have' category. The card itself is a physical device that stores a digital certificate or cryptographic key, which the user must possess to authenticate. Unlike knowledge-based or biometric factors, possession of the smart card is the core authentication mechanism, often combined with a PIN (Type 1) for two-factor authentication.

Answer

Somewhere you are

Answer

Type 3 (something you are)

Answer

Type 1 (something you know)

Question 7

An organization requires users to authenticate with a password and a one-time code sent to their mobile phone. This is an example of which authentication method?

Accepted Answer

Multi-factor authentication. Using two different types of factors (password - Type 1, OTP - Type 2) constitutes multi-factor authentication.

Answer

Two-step verification

Answer

Single-factor authentication

Answer

Step-up authentication

Question 8

In Kerberos authentication, which component issues a Ticket Granting Ticket (TGT) after verifying the user's credentials?

Accepted Answer

Authentication Server (AS). The Authentication Server (AS) verifies the user's credentials and issues a TGT, which the user can then use to request service tickets from the TGS.

Answer

Domain Controller

Answer

Ticket Granting Server (TGS)

Answer

Key Distribution Center (KDC)

Question 9

An attacker who has compromised the Kerberos Key Distribution Center (KDC) could forge a Ticket Granting Ticket (TGT) to impersonate any user. This type of attack is known as:

Accepted Answer

Golden ticket attack. A golden ticket attack involves forging a TGT using the KRBTGT account hash, granting access to any resource in the domain.

Answer

Silver ticket attack

Answer

Pass-the-ticket attack

Answer

Kerberos poisoning attack

Question 10

Which OAuth 2.0 grant type is recommended for a public client (e.g., single-page application) that cannot securely store a client secret?

Accepted Answer

Authorization code grant with PKCE. The authorization code grant with PKCE (Proof Key for Code Exchange) is designed for public clients to prevent interception of the authorization code.

Answer

Resource owner password credentials grant

Answer

Implicit grant

Answer

Client credentials grant

Question 11

OpenID Connect (OIDC) extends OAuth 2.0 primarily by adding which capability?

Accepted Answer

User authentication. OpenID Connect (OIDC) is an identity layer built on top of OAuth 2.0 that primarily adds user authentication. While OAuth 2.0 provides authorization delegation (access tokens for resources), OIDC introduces an ID token (a JSON Web Token, JWT) that contains claims about the authenticated user, enabling the client to verify the user's identity. This is defined in the OIDC specification (OpenID Foundation) and is the key differentiator from plain OAuth 2.0.

Answer

Client credential management

Answer

Authorization delegation

Answer

Token introspection

Question 12

An organization is implementing identity management and wants to ensure that when an employee leaves, all access is promptly revoked. Which process is most directly responsible for removing accounts and access rights for a leaver?

Accepted Answer

Deprovisioning. Deprovisioning is the process of removing user accounts and access rights when an employee leaves the organization. It directly addresses the requirement to promptly revoke all access, ensuring that the former employee cannot authenticate or authorize any actions within the system. This process typically involves disabling or deleting the user object in the directory service (e.g., Active Directory) and removing associated permissions from all resources.

Answer

Privileged access management

Answer

Access recertification

Answer

Separation of duties

Question 13

A security analyst is reviewing access rights and discovers an active account belonging to a former employee who left six months ago. This is an example of:

Accepted Answer

Orphaned account. An orphaned account is one that remains active after the user has left the organization, posing a security risk.

Answer

Separation of duties violation

Answer

Account lockout

Answer

Privilege escalation

Question 14

In a Privileged Access Management (PAM) solution, which feature provides temporary elevation of privileges for specific tasks, reducing the risk of standing privileges?

Accepted Answer

Just-in-time (JIT) access. Just-in-time (JIT) access grants privileges only when needed, reducing the attack surface from permanent privileged accounts.

Answer

Password vaulting

Answer

Break-glass account

Answer

Session recording

Question 15

In LDAP, what does the Distinguished Name (DN) uniquely identify?

Accepted Answer

An entry in the directory. The DN is the unique identifier for an entry in the LDAP directory, consisting of a sequence of Relative Distinguished Names (RDNs).

Answer

The root of the directory

Answer

The schema of the directory

Answer

A group within the directory