CISSP Identity and Access Management Practice Test 3 — 15 Questions

Question 1

A security analyst is reviewing access controls for a financial application. Which TWO of the following are considered best practices for preventing fraud? (Select TWO.)

Accepted Answer

Two-person control. Two-person control (D) is a best practice for preventing fraud because it requires two authorized individuals to perform a critical action, such as approving a high-value transaction or accessing a sensitive system. This ensures collusion is needed to commit fraud, as no single person can complete the action alone. In a financial application, this might involve dual approval for wire transfers over a threshold, directly mitigating insider threats.

Answer

Password complexity

Answer

Single sign-on

Answer

Least privilege

Question 2

An organization is implementing a Privileged Access Management (PAM) solution. Which THREE of the following are common features of PAM? (Select THREE.)

Accepted Answer

Password vaulting. PAM typically includes password vaulting, session recording, and just-in-time access. Break-glass accounts are also a feature, but the question asks for three of the most common.

Answer

Single sign-on

Answer

Role-based access control

Question 3

Which of the following is an example of a Type 1 authentication factor?

Accepted Answer

Password. A Type 1 factor is something you know, such as a password, PIN, or security question.

Answer

OTP token

Answer

Fingerprint

Answer

Smart card

Question 4

In Kerberos authentication, what is the purpose of the Ticket Granting Ticket (TGT)?

Accepted Answer

To prove the user's identity to the Ticket Granting Service (TGS). The TGT is obtained from the AS and used to request service tickets from the TGS without re-entering credentials.

Answer

To store the user's password hash

Answer

To encrypt all communication between client and server

Answer

To authenticate the user to the resource server directly

Question 5

A security analyst discovers that an attacker has gained domain admin privileges by forging a Kerberos TGT using the KRBTGT account hash. Which attack has occurred?

Accepted Answer

Golden ticket attack. A Golden Ticket attack involves forging a TGT with the KRBTGT hash, granting unrestricted access.

Answer

Pass-the-ticket attack

Answer

Silver ticket attack

Answer

Kerberos brute force attack

Question 6

In SAML 2.0, which component is responsible for authenticating the user and generating an assertion?

Accepted Answer

Identity Provider (IdP). The Identity Provider (IdP) authenticates users and creates assertions containing authentication/attribute/authorization data.

Answer

Service Provider (SP)

Answer

Certificate Authority (CA)

Answer

Relying Party (RP)

Question 7

An organization wants to enable single sign-on (SSO) across multiple web applications using an XML-based protocol that supports browser redirect flows. Which technology is most appropriate?

Accepted Answer

SAML 2.0. SAML 2.0 is XML-based and uses browser redirects for SSO between IdP and SPs.

Answer

Kerberos

Answer

OAuth 2.0

Answer

OpenID Connect (OIDC)

Question 8

In OAuth 2.0, which grant type is recommended for a native mobile application that cannot securely store a client secret, and uses PKCE?

Accepted Answer

Authorization Code grant with PKCE. The Authorization Code grant with PKCE is designed for public clients like mobile apps to prevent interception of the authorization code.

Answer

Client Credentials grant

Answer

Implicit grant

Answer

Device Code grant

Question 9

Which of the following is a process that ensures users periodically confirm they still need access to systems and data?

Accepted Answer

Recertification. Access recertification (or access review) requires users or managers to verify the continued need for access rights.

Answer

Deprovisioning

Answer

Separation of duties

Answer

Provisioning

Question 10

A financial application requires two employees to authorize a wire transfer. Which principle does this implement?

Accepted Answer

Separation of duties. Separation of duties (SoD) is the principle that requires two or more individuals to complete a sensitive transaction, such as a wire transfer, to prevent fraud or error. By mandating two employees to authorize the transfer, the application ensures no single person has unchecked control over the entire process, enforcing a dual-control mechanism. This directly implements the SoD principle, which is a core access control concept in identity and access management.

Answer

Least privilege

Answer

Need-to-know

Answer

Zero standing privileges

Question 11

An organization implements Privileged Access Management (PAM) and wants to reduce the risk of standing privileges. Which approach grants temporary elevated access only when needed?

Accepted Answer

Just-in-time access. Just-in-time (JIT) access provides time-limited privileges that are granted on demand, reducing the attack surface.

Answer

Session recording

Answer

Password vaulting

Answer

Break-glass accounts

Question 12

In LDAP, which attribute uniquely identifies an entry within the directory information tree?

Accepted Answer

Distinguished Name (DN). The Distinguished Name (DN) uniquely identifies each entry in the LDAP directory tree.

Answer

Relative Distinguished Name (RDN)

Answer

Organizational Unit (OU)

Answer

Common Name (CN)

Question 13

Which access control model assigns permissions based on a user's job function?

Accepted Answer

RBAC. Role-Based Access Control (RBAC) uses roles that group permissions according to job functions.

Answer

MAC

Answer

DAC

Answer

ABAC

Question 14

A security administrator is reviewing potential risks associated with orphaned accounts. Which TWO of the following are risks of orphaned accounts?

Accepted Answer

Attackers can use orphaned accounts to gain unauthorized access. Orphaned accounts are active accounts of former employees or unused accounts, which can be exploited to gain unauthorized access or persist undetected.

Answer

Compliance with password policies is weakened

Answer

Performance degradation of authentication servers

Answer

Increased logging overhead

Question 15

Which THREE of the following are components of a Privileged Access Management (PAM) solution?

Accepted Answer

Session recording. PAM typically includes password vaulting (secure credential storage), session recording (monitoring privileged sessions), and just-in-time access (elevated privileges on demand).

Answer

User self-service password reset

Answer

Single sign-on for web applications