CISSP Identity and Access Management Practice Test 4 — 15 Questions

Question 1

Which TWO of the following are differences between OAuth 2.0 and OpenID Connect (OIDC)?

Accepted Answer

OAuth 2.0 is for authorization, while OIDC is for authentication. OAuth 2.0 is fundamentally an authorization framework (RFC 6749) that grants delegated access to resources, while OpenID Connect (OIDC) is an authentication layer built on top of OAuth 2.0 (specified in OpenID Connect Core 1.0) that verifies the end-user's identity. OIDC extends OAuth 2.0 by adding an ID token (a JWT) that contains claims about the authenticated user, whereas OAuth 2.0 alone does not provide identity information.

Answer

OAuth 2.0 supports device code grant, OIDC does not

Answer

OIDC is XML-based, while OAuth 2.0 is JSON-based

Answer

OAuth 2.0 requires a client secret, OIDC does not

Question 2

Which of the following is an example of a Type 2 authentication factor?

Accepted Answer

Smart card. A Type 2 factor is something you have, such as a smart card or OTP token.

Answer

Security question

Answer

Password

Answer

Fingerprint

Question 3

A security architect is designing an authentication system for a healthcare application that requires strong security. The system will use a password and a one-time passcode sent via SMS. How many authentication factor types are being used?

Accepted Answer

Two. Password is Type 1 (something you know), SMS OTP is Type 2 (something you have, as the phone is possessed). Only two factor types are used.

Answer

Three

Answer

Four

Answer

One

Question 4

During a Kerberos authentication process, the client receives a Ticket Granting Ticket (TGT) from the Authentication Server (AS). Later, the client presents the TGT to the Ticket Granting Server (TGS) to request a service ticket. Which of the following best describes the purpose of the TGT?

Accepted Answer

It allows the client to request additional service tickets without re-authentication.. The TGT is a credential that proves the user has been authenticated by the AS and is allowed to request service tickets without re-entering credentials.

Answer

It verifies the client's IP address to prevent replay attacks.

Answer

It encrypts the session key between the client and the target service.

Answer

It authenticates the user to the target service directly.

Question 5

An organization implements Single Sign-On (SSO) using SAML 2.0. A user attempts to access a cloud application (Service Provider) but is not authenticated. The Service Provider redirects the user to the Identity Provider (IdP) for authentication. Which type of SAML flow is this?

Accepted Answer

SP-initiated SSO. In SP-initiated SSO, the user first tries to access the SP, which then redirects to the IdP.

Answer

AuthN-initiated SSO

Answer

Assertion-initiated SSO

Answer

IdP-initiated SSO

Question 6

A developer is implementing OAuth 2.0 for a mobile app (public client) that needs to access a user's data from a third-party API. To mitigate the authorization code interception attack, which OAuth 2.0 extension should be used?

Accepted Answer

PKCE. PKCE (Proof Key for Code Exchange) is designed for public clients to prevent interception of the authorization code.

Answer

Device code grant

Answer

Client credentials grant

Answer

Implicit grant

Question 7

A financial institution requires that no single employee can approve a transaction and also reconcile the account. This is an example of which security principle?

Accepted Answer

Separation of duties. Separation of duties (SoD) is the security principle that prevents a single individual from having conflicting responsibilities, such as both approving a transaction and reconciling the account. This reduces the risk of fraud or error by requiring collusion between two or more people to subvert a process. In a financial system, SoD is enforced through access control mechanisms that assign distinct roles (e.g., 'Transaction Approver' and 'Account Reconciler') with mutually exclusive permissions, often implemented via Role-Based Access Control (RBAC) or attribute-based policies.

Answer

Least privilege

Answer

Defense in depth

Answer

Need to know

Question 8

Which of the following is a lightweight directory access protocol used for accessing and maintaining distributed directory information?

Accepted Answer

LDAP. LDAP (Lightweight Directory Access Protocol) is used for directory services.

Answer

OAuth

Answer

Kerberos

Answer

SAML

Question 9

An organization discovers that a former employee's account is still active and has been used to access sensitive data. This is an example of which type of risk?

Accepted Answer

Orphaned account. An orphaned account is one that remains active after an employee has left, posing a security risk.

Answer

Privilege escalation

Answer

Social engineering

Answer

Insider threat

Question 10

Which TWO of the following are characteristics of a Privileged Access Management (PAM) solution? (Choose two.)

Accepted Answer

Session recording. PAM includes password vaulting and session recording; just-in-time access is also a characteristic, but note: the question asks for TWO, so select the correct two.

Answer

Self-service password reset

Answer

Single sign-on for all users

Answer

OpenID Connect authentication

Question 11

Which TWO of the following are OAuth 2.0 grant types? (Choose two.)

Accepted Answer

Client credentials. Authorization code and client credentials are standard OAuth 2.0 grant types.

Answer

SAML assertion

Answer

LDAP bind

Answer

Kerberos ticket

Question 12

A security analyst is performing an access review. Which THREE of the following are best practices for user access recertification? (Choose three.)

Accepted Answer

Managers confirm that employees still need their current access. Recertification should confirm business need, review actual access, and be periodic.

Answer

Remove all access and re-provision as needed

Answer

Automatically approve access if no response

Question 13

In the context of identity management, which TWO of the following are risks associated with orphaned accounts? (Choose two.)

Accepted Answer

Compliance violations. Orphaned accounts can be used by former employees or attackers, and may violate compliance.

Answer

Reduced system performance

Answer

Enhanced audit logging

Answer

Increased help desk calls

Question 14

An organization is implementing OpenID Connect (OIDC) for authentication. Which THREE of the following are components of OIDC? (Choose three.)

Accepted Answer

Authorization code flow. OIDC uses ID token, UserInfo endpoint, and OAuth 2.0 authorization framework.

Answer

Kerberos ticket granting ticket

Answer

SAML assertion

Question 15

Which TWO of the following are examples of Type 3 authentication factors? (Choose two.)

Accepted Answer

Fingerprint. Type 3 factors are biometrics: fingerprint and retina scan.

Answer

Password

Answer

Smart card

Answer

One-time password token