CISSP Identity and Access Management — 30 Questions

Question 1

An organization requires users to authenticate with a password and a one-time code sent to their mobile phone. This is an example of which authentication method?

Accepted Answer

Multi-factor authentication. Using a password plus a one-time code sent to a mobile phone is multi-factor authentication (MFA) because it combines two different factor categories: something you know (password) and something you have (the mobile phone receiving the code). MFA requires at least two distinct factor types, which this satisfies.

Answer

Two-step verification

Answer

Single-factor authentication

Answer

Step-up authentication

Question 2

Which statement about SAML 2.0 is correct?

Accepted Answer

SAML relies on browser redirects for SSO flows.. SAML 2.0 (specifically the Web Browser SSO Profile) relies on the user's browser to redirect the user-agent between the Service Provider (SP) and the Identity Provider (IdP) using bindings such as HTTP Redirect or HTTP POST. SAML uses XML (not JSON) for its assertions, supports both IdP-initiated and SP-initiated SSO flows, and is primarily designed for federated authentication (identity assertion) rather than fine-grained authorization.

Answer

SAML supports only IdP-initiated SSO.

Answer

SAML uses JSON for its assertions.

Answer

SAML is primarily used for authorization, not authentication.

Question 3

A security architect is designing a Single Sign-On (SSO) solution for a web application that needs to support authentication and authorization. Which TWO of the following protocols are best suited for this purpose? (Select TWO)

Accepted Answer

OpenID Connect (OIDC). OpenID Connect (OIDC) is correct because it is a modern identity layer built on top of OAuth 2.0 that provides both authentication (via the ID token, a signed JWT) and authorization (via access tokens and scopes), making it ideal for web application SSO. SAML 2.0 is also correct because it is a mature XML-based federation standard that exchanges authentication and authorization assertions between an Identity Provider and a Service Provider, and it is widely used for browser-based web SSO. Kerberos is not appropriate here because it is a ticket-based network authentication protocol designed primarily for domain environments rather than federated web SSO. LDAP is a directory access protocol used to store and query identity data, not a web SSO authentication/authorization protocol. OAuth 2.0 is an authorization framework only; it delegates access via access tokens but does not itself authenticate users or provide identity assertions, so it is not the best fit for SSO authentication.

Answer

Kerberos

Answer

LDAP

Answer

OAuth 2.0

Question 4

An organization is implementing Privileged Access Management (PAM). Which THREE of the following are common features of a PAM solution? (Select THREE)

Accepted Answer

Password vaulting. Common PAM features include password vaulting, just-in-time (JIT) access, and session recording/monitoring. Single Sign-On (SSO) and self-service password reset (SSPR) are general Identity and Access Management (IAM) features rather than core Privileged Access Management (PAM) capabilities.

Answer

Self-service password reset

Answer

Break-glass access

Question 5

In Kerberos, which component issues ticket-granting tickets (TGTs) after verifying the user's credentials?

Accepted Answer

Authentication Server (AS). In Kerberos, the Authentication Server (AS) is the component that verifies the user's credentials (typically by decrypting a timestamp with the user's long-term key derived from their password) and, upon success, issues a Ticket-Granting Ticket (TGT) along with a session key. The TGT is then used to request service tickets from the Ticket Granting Server (TGS).

Answer

Domain Controller

Answer

Ticket Granting Server (TGS)

Answer

Key Distribution Center (KDC)

Question 6

An attacker has obtained a Kerberos TGT and uses it to request service tickets for any resource in the domain. Which type of attack is this?

Accepted Answer

Pass-the-ticket attack. A Pass-the-ticket attack involves an attacker stealing a Kerberos ticket (TGT or service ticket) and using it to authenticate to resources without needing the user's password. In this scenario, the attacker has obtained a TGT and is requesting service tickets, which is characteristic of a Pass-the-ticket attack. A Golden Ticket attack involves forging a TGT using the KRBTGT account hash, which is not described here.

Answer

Replay attack

Answer

Golden ticket attack

Answer

Kerberos cracking

Question 7

A company implements a policy requiring two different employees to approve a payment transaction. This is an example of:

Accepted Answer

Dual control. Separation of duties (SoD) prevents fraud by ensuring that a single person cannot initiate and complete a critical transaction alone. By requiring one employee to initiate the payment and another to approve it, the process is split, mitigating the risk of collusion and unauthorized transactions.

Answer

Need-to-know

Answer

Least privilege

Answer

Two-person control

Question 8

An organization uses Active Directory and needs to enforce password complexity settings for all users in a specific department. What is the most efficient way to achieve this?

Accepted Answer

Use a script to set passwords for each user. In Active Directory, standard domain password policies can only be set at the domain level (typically via the Default Domain Policy). Linking a GPO to an OU to change password settings for domain users in that OU does not work; it only affects local accounts on the computers inside that OU. To enforce different password complexity settings for a specific department, you must use Fine-Grained Password Policies (FGPP) by creating a Password Settings Object (PSO) and applying it to a global security group containing the department's users.

Answer

Configure password settings in the user's individual properties

Answer

Apply a Group Policy Object (GPO) to the OU containing the department's users

Answer

Create a password policy in the Default Domain Policy

Question 9

Which of the following is an example of a Type 2 authentication factor?

Accepted Answer

Smart card. A smart card is a Type 2 authentication factor because it relies on 'something you have' — a physical token the user must possess. Type 2 factors are possession-based, distinct from Type 1 (something you know, like passwords) and Type 3 (something you are, like biometrics). The smart card's cryptographic chip proves possession during authentication.

Answer

Security question

Answer

Password

Answer

Fingerprint

Question 10

Which of the following access control models allows the data owner to decide who can access their resources?

Accepted Answer

Discretionary Access Control (DAC). Discretionary Access Control (DAC) is the correct answer because it allows the data owner (the creator or custodian of the resource) to decide who can access their resources and at what privilege level. In DAC, access rights are assigned based on the owner's discretion, typically using Access Control Lists (ACLs) or owner-based permissions, as seen in file systems like NTFS or UNIX chmod.

Answer

Attribute-Based Access Control (ABAC)

Answer

Mandatory Access Control (MAC)

Answer

Role-Based Access Control (RBAC)

Question 11

Which authentication factor type is a smart card?

Accepted Answer

Type 2 (something you have). A smart card is a Type 2 authentication factor because it falls under the 'something you have' category. The card itself is a physical device that stores a digital certificate or cryptographic key, which the user must possess to authenticate. Unlike knowledge-based or biometric factors, possession of the smart card is the core authentication mechanism, often combined with a PIN (Type 1) for two-factor authentication.

Answer

Somewhere you are

Answer

Type 3 (something you are)

Answer

Type 1 (something you know)

Question 12

In Kerberos authentication, which component issues a Ticket Granting Ticket (TGT) after verifying the user's credentials?

Accepted Answer

Authentication Server (AS). In Kerberos, the Authentication Server (AS) is the component that verifies the user's credentials (typically by decrypting a timestamp with the user's long-term key) and issues the Ticket Granting Ticket (TGT). The AS is part of the Key Distribution Center (KDC), but it is specifically the AS that performs authentication and returns the TGT. This makes Authentication Server the correct answer.

Answer

Domain Controller

Answer

Ticket Granting Server (TGS)

Answer

Key Distribution Center (KDC)

Question 13

An attacker who has compromised the Kerberos Key Distribution Center (KDC) could forge a Ticket Granting Ticket (TGT) to impersonate any user. This type of attack is known as:

Accepted Answer

Golden ticket attack. A Golden Ticket attack involves compromising the Kerberos Key Distribution Center (KDC), specifically the KRBTGT account's password hash. With this hash, an attacker can forge a legitimate Ticket Granting Ticket (TGT) that grants access to any service or resource in the domain, effectively impersonating any user. This is possible because the KRBTGT account is used to sign all TGTs, and its compromise allows the attacker to mint arbitrary TGTs. The attack is called 'Golden' because it grants unlimited access, akin to having a master key to the domain.

Answer

Silver ticket attack

Answer

Pass-the-ticket attack

Answer

Kerberos poisoning attack

Question 14

Which OAuth 2.0 grant type is recommended for a public client (e.g., single-page application) that cannot securely store a client secret?

Accepted Answer

Authorization code grant with PKCE. Authorization Code grant with PKCE (Proof Key for Code Exchange, RFC 7636) is the OAuth 2.0 best current practice for public clients like SPAs and mobile apps that cannot keep a client secret confidential. PKCE adds a dynamically generated code_verifier and its hashed code_challenge to the authorization request, so even if the authorization code is intercepted, it cannot be exchanged without the verifier. This mitigates authorization code interception attacks that plague public clients.

Answer

Resource owner password credentials grant

Answer

Implicit grant

Answer

Client credentials grant

Question 15

OpenID Connect (OIDC) extends OAuth 2.0 primarily by adding which capability?

Accepted Answer

User authentication. OpenID Connect (OIDC) is an identity layer built on top of OAuth 2.0 that primarily adds user authentication. While OAuth 2.0 provides authorization delegation (access tokens for resources), OIDC introduces an ID token (a JSON Web Token, JWT) that contains claims about the authenticated user, enabling the client to verify the user's identity. This is defined in the OIDC specification (OpenID Foundation) and is the key differentiator from plain OAuth 2.0.

Answer

Client credential management

Answer

Authorization delegation

Answer

Token introspection

Question 16

An organization is implementing identity management and wants to ensure that when an employee leaves, all access is promptly revoked. Which process is most directly responsible for removing accounts and access rights for a leaver?

Accepted Answer

Deprovisioning. Deprovisioning is the process of removing user accounts and access rights when an employee leaves the organization. It directly addresses the requirement to promptly revoke all access, ensuring that the former employee cannot authenticate or authorize any actions within the system. This process typically involves disabling or deleting the user object in the directory service (e.g., Active Directory) and removing associated permissions from all resources.

Answer

Privileged access management

Answer

Access recertification

Answer

Separation of duties

Question 17

A security analyst is reviewing access rights and discovers an active account belonging to a former employee who left six months ago. This is an example of:

Accepted Answer

Orphaned account. An orphaned account is one that remains active after its owner no longer needs it — typically because the employee left, changed roles, or the account was never deprovisioned. A former employee's account still active six months after departure is the textbook definition of an orphaned account. It represents a significant access control failure because the account can be used without legitimate ownership.

Answer

Separation of duties violation

Answer

Account lockout

Answer

Privilege escalation

Question 18

In a Privileged Access Management (PAM) solution, which feature provides temporary elevation of privileges for specific tasks, reducing the risk of standing privileges?

Accepted Answer

Just-in-time (JIT) access. Just-in-time (JIT) access in a PAM solution provides temporary, on-demand elevation of privileges for specific tasks, eliminating standing privileges that attackers can exploit. It typically involves approval workflows, time-bound access, and automatic revocation. This reduces the attack surface and limits lateral movement.

Answer

Password vaulting

Answer

Break-glass account

Answer

Session recording

Question 19

In LDAP, what does the Distinguished Name (DN) uniquely identify?

Accepted Answer

An entry in the directory. In LDAP, the Distinguished Name (DN) is a globally unique identifier for a single entry in the directory, composed of a sequence of Relative Distinguished Names (RDNs) that describe the entry's path from the leaf to the root. For example, cn=John Doe,ou=Users,dc=example,dc=com uniquely identifies one entry. The DN is used in bind operations, search base specifications, and modify operations to target a specific entry.

Answer

The root of the directory

Answer

The schema of the directory

Answer

A group within the directory

Question 20

Which access control model allows the owner of a resource to determine who can access it and what permissions they have?

Accepted Answer

Discretionary Access Control (DAC). Discretionary Access Control (DAC) allows the resource owner to control access at their discretion.

Answer

Role-Based Access Control (RBAC)

Answer

Mandatory Access Control (MAC)

Answer

Attribute-Based Access Control (ABAC)