CISSP Identity and Access Management — 15 Questions

Question 1

A healthcare organization implements a policy requiring all employees to use biometric fingerprint scanners to access patient records. Which of the following is the MOST significant risk associated with this authentication method?

Accepted Answer

Biometric data cannot be revoked or changed if compromised. Biometric data, such as fingerprint templates, is immutable and permanently tied to the individual. Once compromised, the user cannot simply 'reset' their fingerprint like a password, rendering the authentication factor permanently insecure for that user across all systems where it is used. This non-repudiation and revocation failure represents the most significant long-term risk to the organization's identity management infrastructure.

Answer

High false acceptance rate leading to unauthorized access

Answer

Low user acceptance due to privacy concerns

Answer

Increased login time compared to password authentication

Question 2

A multinational corporation deploys a single sign-on (SSO) solution using SAML 2.0 across all subsidiaries. Recently, users in one subsidiary report being unable to access an internal application. The identity provider (IdP) logs show successful authentication, but the service provider (SP) logs indicate assertion validation failures. Which of the following is the MOST likely cause?

Accepted Answer

The system clocks on the IdP and SP are significantly out of sync. SAML 2.0 relies on timestamps (NotBefore and NotOnOrAfter) within the assertion for validity. If the system clocks on the identity provider (IdP) and service provider (SP) are significantly out of sync, the SP will reject the assertion as expired or not yet valid, even though the IdP logs show successful authentication. This is the most common cause of assertion validation failures in cross-domain SSO deployments.

Answer

The SP is configured to require a specific SAML attribute not present in the assertion

Answer

The IdP server for the subsidiary is temporarily unreachable

Answer

The SAML certificate used by the SP has expired

Question 3

An organization wants to implement a password policy that balances security and usability. Which of the following is the BEST practice according to current NIST guidelines?

Accepted Answer

Compare new passwords against a list of known compromised passwords. NIST SP 800-63B explicitly recommends checking passwords against a list of known compromised passwords (e.g., from previous breaches) rather than enforcing arbitrary complexity rules. This approach directly mitigates credential stuffing and dictionary attacks by rejecting passwords that have already been exposed, while avoiding user frustration from frequent changes or complex composition requirements.

Answer

Set maximum password length to 8 characters

Answer

Require password changes every 30 days

Answer

Enforce a minimum of one uppercase, one lowercase, one digit, and one special character

Question 4

A company uses Role-Based Access Control (RBAC) for its ERP system. A user in the 'Accounts Payable' role needs to temporarily approve purchase orders up to $10,000 while the 'Purchasing Manager' is on leave. What is the BEST way to grant this access?

Accepted Answer

Temporarily assign the 'Purchasing Approver' role to the user with an expiration date. Option B is correct because it follows the principle of least privilege by temporarily assigning the 'Purchasing Approver' role to the user with an expiration date, ensuring that the elevated permissions are automatically revoked after the leave period. This approach maintains RBAC integrity without permanently altering role definitions or sharing credentials.

Answer

Share the Purchasing Manager's account credentials with the user

Answer

Modify the 'Accounts Payable' role to include purchase order approval permissions

Answer

Create a new role with the exact permissions needed and assign it to the user

Question 5

A security analyst discovers that a service account in Active Directory has not had its password changed in 5 years and has domain admin privileges. The account is used by a legacy application that does not support modern authentication protocols. Which of the following is the MOST secure approach to manage this account?

Accepted Answer

Decommission the legacy application and migrate to a modern alternative that supports secure authentication. Option D is correct because the best security is to decommission the account and modernize the application. Option A is wrong because group Managed Service Accounts (gMSAs) require Windows Server 2012 or later and application support. Option B is wrong because a long, complex password still has risk of theft and is not automatically rotated. Option C is wrong because disabling the account would break the application.

Answer

Convert the account to a group Managed Service Account (gMSA)

Answer

Set a very long, complex password and store it in a password manager

Answer

Disable the account and create a new service account with limited privileges

Question 6

A company wants to implement multi-factor authentication (MFA) for remote access. Which combination of factors represents something you have and something you are?

Accepted Answer

Smart card and fingerprint. Option C is correct because a smart card is a physical device that you possess (something you have), and a fingerprint is a biometric characteristic unique to you (something you are). This combination satisfies the multi-factor authentication requirement by using two distinct factors from different categories, which is more secure than using two factors from the same category.

Answer

Password and PIN

Answer

Hardware token and mobile phone

Answer

Password and SMS code

Question 7

An organization uses OAuth 2.0 for delegated access to APIs. A developer creates a public client application that runs on mobile devices. Which OAuth 2.0 grant type is MOST appropriate for this scenario?

Accepted Answer

Authorization Code Grant with PKCE. The Authorization Code Grant with PKCE (Proof Key for Code Exchange) is the most appropriate for a public client on a mobile device because it prevents authorization code interception attacks. PKCE replaces the client secret with a dynamically generated code verifier and challenge, ensuring that even if the authorization code is intercepted, it cannot be exchanged for tokens without the original verifier. This is the OAuth 2.0 Security Best Current Practice (BCP) recommendation for native and mobile apps.

Answer

Client Credentials Grant

Answer

Implicit Grant

Answer

Resource Owner Password Credentials Grant

Question 8

Which TWO of the following are valid methods to enforce separation of duties in an access control system?

Accepted Answer

Using time-based restrictions to prevent overlapping tasks. Time-based restrictions enforce separation of duties by preventing a single user from performing conflicting tasks during overlapping time periods. For example, a user authorized to initiate a payment transaction cannot also approve it within the same time window, ensuring that no single individual has end-to-end control over a sensitive process. This is a technical control that directly supports the principle of separation of duties in an access control system.

Answer

Requiring mandatory vacations for all employees

Answer

Performing job rotation every six months

Answer

Configuring shared accounts for each department

Question 9

Which THREE of the following are characteristics of a federated identity management system?

Accepted Answer

It relies on standard protocols such as SAML or OpenID Connect. Option A is correct because federated identity management systems rely on standard protocols like SAML (Security Assertion Markup Language) or OpenID Connect to exchange authentication and authorization data between identity providers (IdPs) and service providers (SPs). These protocols enable trust relationships across different security domains without requiring shared directories or a single IdP.

Answer

It operates with a single identity provider for all organizations

Answer

It requires all participating organizations to use the same user directory

Question 10

Which TWO of the following are types of access control models?

Accepted Answer

Discretionary Access Control (DAC). Discretionary Access Control (DAC) is an access control model where the owner of a resource (e.g., a file or object) has the authority to grant or deny access to other subjects. This is typically implemented using Access Control Lists (ACLs) on objects, allowing the owner to set permissions (e.g., read, write, execute) for specific users or groups. DAC is defined in the Trusted Computer System Evaluation Criteria (TCSEC) as a fundamental model for controlling access based on the identity of subjects and/or the groups to which they belong.

Answer

SAML

Answer

Kerberos

Answer

LDAP

Question 11

Refer to the exhibit. A user reports they cannot authenticate to a web application after receiving a new token. The error log shows the above entries. Which of the following is the MOST likely cause?

Accepted Answer

The token was signed with a different secret key than the one used by the verifier. The error log entries indicate a signature validation failure, which occurs when the token was signed with a secret key that differs from the one the verifier uses. In JSON Web Token (JWT) authentication, the verifier must possess the exact same secret (for HMAC) or the corresponding public key (for RSA/ECDSA) to validate the signature; a mismatch causes authentication to fail. This is the most likely cause because the user received a new token, suggesting a key rotation or misconfiguration where the signing key was changed without updating the verifier.

Answer

The token uses a different signing algorithm than expected

Answer

The token has expired

Answer

The token's issuer claim does not match the expected issuer

Question 12

Refer to the exhibit. A user 'jdoe' is a member of the Domain Users group but not of the Administrators or Remote Desktop Users groups. The user reports they cannot log on locally to a domain-joined Windows server, but they can log on via RDP. Based on the GPO results, what is the MOST likely reason?

Accepted Answer

The user is not a member of the local Users group or Administrators group. The user 'jdoe' can log on via RDP but not locally because the default security policy on a domain-joined Windows server grants the 'Allow log on locally' right only to the local Administrators group and the local Users group. Since 'jdoe' is a member of Domain Users, which is mapped to the local Users group on a domain-joined server, the user should normally have local logon rights. However, the exhibit shows GPO results that likely indicate the local Users group has been removed from the 'Allow log on locally' policy, or the user is not actually a member of the local Users group (e.g., the server is configured to not map Domain Users to the local Users group). The most direct reason is that the user is not a member of either the local Users group or the local Administrators group, which are the only groups granted local logon by default.

Answer

The user is a member of the Remote Desktop Users group

Answer

The user is a member of a group that is denied local logon

Answer

The user is denied logon through Remote Desktop Services

Question 13

A medium-sized financial services company recently deployed a new identity governance and administration (IGA) solution to manage user access across on-premises Active Directory and cloud-based SaaS applications. The IGA system uses a role-based access control (RBAC) model with hundreds of roles defined. The company has a policy that all access certifications must be completed quarterly. During the first quarterly certification, the access reviewers complain that they are overwhelmed by the number of entitlements they need to review, and many certifications are not completed on time. The security team also notices that some users have accumulated excessive privileges because role assignments were not properly reviewed. The company wants to streamline the certification process without sacrificing security. Which of the following is the BEST course of action?

Accepted Answer

Implement a risk-based certification approach that focuses on high-risk access and uses automated certification for low-risk access. Option C is correct because a risk-based certification approach prioritizes high-risk entitlements for manual review while automating the certification of low-risk access, reducing reviewer fatigue and ensuring critical privileges are scrutinized. This aligns with the principle of 'defense in depth' and addresses the core issue of overwhelming certification volume without compromising security, as low-risk access can be certified based on predefined policies and automated workflows.

Answer

Increase the certification frequency to monthly and assign more reviewers

Answer

Eliminate role-based access and assign permissions directly to users

Answer

Automate all certifications by using scripts that approve access if no violations are detected

Question 14

Drag and drop the steps for implementing a digital signature using asymmetric cryptography in the correct order.

Question 15

Match each access control type to its description.