CISSP Identity and Access Management Practice Test 2 — 15 Questions

Question 1

Which access control model allows the owner of a resource to determine who can access it and what permissions they have?

Accepted Answer

Discretionary Access Control (DAC). Discretionary Access Control (DAC) allows the resource owner to control access at their discretion.

Answer

Role-Based Access Control (RBAC)

Answer

Mandatory Access Control (MAC)

Answer

Attribute-Based Access Control (ABAC)

Question 2

A security policy requires that a user cannot have both the ability to create purchase orders and approve invoices. This is an example of:

Accepted Answer

Separation of duties. Separation of Duties (SoD) is a control that prevents a single individual from performing conflicting duties, reducing the risk of fraud.

Answer

Need-to-know

Answer

Least privilege

Answer

Job rotation

Question 3

A security architect is designing a Single Sign-On (SSO) solution for a web application that needs to support authentication and authorization. Which TWO of the following protocols are best suited for this purpose? (Select TWO)

Accepted Answer

OpenID Connect (OIDC). SAML 2.0 and OpenID Connect (OIDC) are both SSO protocols that provide authentication and authorization. OAuth 2.0 alone provides only authorization.

Answer

Kerberos

Answer

LDAP

Answer

OAuth 2.0

Question 4

Which of the following is an example of a Type 2 authentication factor?

Accepted Answer

Smart card. A smart card is a Type 2 authentication factor because it falls under the category of 'something you have.' Type 2 factors are possession-based, meaning the user must physically possess the token to authenticate. Smart cards store cryptographic keys or certificates and require a card reader to present the credential, making them a classic example of a possession factor.

Answer

Answer

Password

Answer

Fingerprint

Question 5

A security administrator is configuring a system that requires users to provide a password and a one-time code from a hardware token. Which authentication method is being implemented?

Accepted Answer

Multi-factor authentication. Using two different factor types (password and hardware token) constitutes multi-factor authentication (MFA).

Answer

Biometric authentication

Answer

Step-up authentication

Answer

Single-factor authentication

Question 6

In Kerberos, which component issues ticket-granting tickets (TGTs) after verifying the user's credentials?

Accepted Answer

Authentication Server (AS). The Authentication Server (AS) is responsible for issuing TGTs after verifying the user's password or other credentials.

Answer

Domain Controller

Answer

Ticket Granting Server (TGS)

Answer

Key Distribution Center (KDC)

Question 7

An attacker has obtained a Kerberos TGT and uses it to request service tickets for any resource in the domain. Which type of attack is this?

Accepted Answer

Pass-the-ticket attack. A golden ticket attack involves forging a TGT, but pass-the-ticket uses a legitimate TGT obtained illegally.

Answer

Replay attack

Answer

Golden ticket attack

Answer

Kerberos cracking

Question 8

Which protocol is specifically designed for authorization and not authentication, often using grant types like authorization code and client credentials?

Accepted Answer

OAuth 2.0. OAuth 2.0 is an authorization framework that provides delegated access; it does not authenticate the user.

Answer

SAML 2.0

Answer

OpenID Connect

Answer

Kerberos

Question 9

In an OAuth 2.0 authorization code flow with PKCE, what is the primary purpose of the code verifier and code challenge?

Accepted Answer

To ensure the client that requested the code is the same one redeeming it. PKCE (Proof Key for Code Exchange) prevents authorization code interception attacks, especially for public clients like mobile apps.

Answer

To encrypt the authorization code

Answer

To authenticate the end user

Answer

To generate the ID token

Question 10

An organization wants to implement single sign-on across multiple web applications using an XML-based protocol that supports identity provider (IdP) and service provider (SP) initiated flows. Which technology should they choose?

Accepted Answer

SAML 2.0. SAML 2.0 is an XML-based protocol for SSO that supports both IdP and SP initiated flows and uses assertions.

Answer

OpenID Connect

Answer

OAuth 2.0

Answer

Kerberos

Question 11

An employee leaves the company, and their user account is not disabled. This creates a security risk known as:

Accepted Answer

Orphaned account. An orphaned account is a user account that remains active in the identity management system after the employee has left the organization. This creates a security risk because the account can be exploited by attackers or former employees to gain unauthorized access to systems, data, or network resources, bypassing access controls that rely on account deactivation.

Answer

Insider threat

Answer

Privilege creep

Answer

Separation of duties violation

Question 12

Which principle ensures that a user is granted only the permissions necessary to perform their job functions?

Accepted Answer

Least privilege. The principle of least privilege states that users should have the minimum level of access required.

Answer

Need-to-know

Answer

Separation of duties

Answer

Zero standing privileges

Question 13

An organization wants to provide just-in-time administrative access to servers, with session recording and password vaulting. Which solution is best suited?

Accepted Answer

Privileged Access Management (PAM). Privileged Access Management (PAM) provides just-in-time access, session recording, password vaulting, and break-glass accounts.

Answer

Identity as a Service (IDaaS)

Answer

Single Sign-On (SSO)

Answer

Role-Based Access Control (RBAC)

Question 14

An LDAP distinguished name (DN) includes the attribute 'CN=John Doe,OU=Sales,DC=company,DC=com'. What does 'CN' stand for?

Accepted Answer

Common Name. CN stands for Common Name, which typically represents the user's name or the hostname of a device.

Answer

Country Name

Answer

Certificate Name

Answer

Container Name

Question 15

Which access control model bases decisions on attributes of the user, resource, and environment, and can use Boolean logic to define policies?

Accepted Answer

Attribute-Based Access Control (ABAC). Attribute-Based Access Control (ABAC) uses attributes and policies to grant access, offering fine-grained control.

Answer

Role-Based Access Control (RBAC)

Answer

Discretionary Access Control (DAC)

Answer

Mandatory Access Control (MAC)