CISSP Identity and Access Management Practice Test 3 — 15 Questions

Question 1

A company implements a centralized authentication system using RADIUS for network devices. The security team notices that after a user's password is changed in Active Directory, the user can still authenticate to network devices using the old password for up to 30 minutes. What is the most likely cause?

Accepted Answer

Network devices caching authentication responses. Option C is correct because network devices often cache successful authentication responses, so they accept the old password until the cache expires. Option A is wrong because RADIUS servers typically forward authentication to the directory and do not cache credentials. Option B is wrong because it is not the primary cause in this scenario. Option D is wrong because Kerberos ticket lifetimes are unrelated to password changes in this context.

Answer

Kerberos ticket lifetime

Answer

Active Directory replication delay

Answer

RADIUS server caching credentials

Question 2

An organization uses a custom application that stores user passwords using salted SHA-256 hashes. During a security audit, the auditor recommends migrating to a more secure password storage mechanism. Which of the following is the best recommendation?

Accepted Answer

Use bcrypt with a cost factor of 12. bcrypt is a deliberately slow, adaptive password hashing function that includes a built-in salt and a configurable cost factor. A cost factor of 12 makes each hash computation computationally expensive, effectively thwarting brute-force and GPU-based attacks. Unlike SHA-256, which is designed for speed and can be cracked rapidly with modern hardware, bcrypt's design inherently resists parallelization and ASIC/GPU acceleration.

Answer

Use plaintext with database encryption

Answer

Use AES-256 encryption for passwords

Answer

Use MD5 with a salt

Answer

Use PBKDF2 with 10,000 iterations

Question 3

A user reports that they cannot access a file share after being moved to a different department. The file share is secured with NTFS permissions and share permissions. The user is a member of the 'Marketing' group, but the file share is only accessible by 'Sales' group. What is the most likely reason?

Accepted Answer

The user is not a member of the Sales group. Option A is correct because the user is not a member of the Sales group, which is required for access. Option B is wrong because there is no indication the account is disabled. Option C is wrong because share permissions are not the primary issue. Option D is wrong because NTFS permissions are not the direct cause.

Answer

The share permissions deny access to Marketing

Answer

The user's account is disabled

Answer

The NTFS permissions deny access

Question 4

A security administrator is configuring role-based access control (RBAC) for a cloud storage system. Which of the following is the best practice for assigning permissions?

Accepted Answer

Create roles based on job functions and assign users to roles. Option C is correct because RBAC assigns permissions to roles, then users are assigned to roles, ensuring scalability and manageability. Option A is wrong because direct permissions are difficult to manage. Option B is wrong after all, user-based permissions are not RBAC. Option D is wrong because MAC is a different model. Option E is wrong because ABAC is attribute-based, not RBAC.

Answer

Use access control lists on each object

Answer

Implement mandatory access control

Answer

Assign permissions directly to users for flexibility

Question 5

An organization uses a federated identity system with SAML. A new service provider (SP) is added, but users cannot authenticate. The identity provider (IdP) logs show that the SAML response is signed correctly, but the SP rejects it. What is the most likely issue?

Accepted Answer

The SP's metadata is missing the IdP's certificate. Option E is correct because the SP must have the IdP's signing certificate in its metadata to validate the SAML response signature. If the SP's metadata is missing the IdP's certificate, the SP cannot verify the signature, causing it to reject the response even though the IdP logs show it was signed correctly.

Answer

The SP does not support HTTP-POST binding

Answer

The IdP's clock is skewed

Answer

The SAML assertion is not encrypted

Answer

The user's browser cookies are blocked

Question 6

A password policy requires passwords to be at least 12 characters, with uppercase, lowercase, digits, and special characters. Which of the following is an example of a password that meets the policy?

Accepted Answer

Password123!. Option E (Password123!) meets the policy because it is 12 characters long and includes uppercase (P), lowercase (assword), digits (123), and a special character (!). The policy requires all four character types, and this password satisfies each requirement without any ambiguity.

Answer

Abcdefghijkl

Answer

Pa$$w0rd

Answer

MyP@ssw0rd1

Answer

SecureP@ss1

Question 7

A company uses smart cards for authentication to workstations. A user inserts their smart card but is prompted for a PIN. The user enters the correct PIN but authentication fails. The smart card is not expired. What is the most likely cause?

Accepted Answer

The user's certificate is revoked. When a smart card is used for authentication, the PIN unlocks the private key stored on the card, but the actual authentication typically relies on a certificate chain and the validity of the user's certificate. If the certificate has been revoked (e.g., due to compromise or termination), the Certificate Revocation List (CRL) or Online Certificate Status Protocol (OCSP) check will fail, causing authentication to be denied even though the PIN is correct and the card is not expired.

Answer

The PIN is incorrectly stored on the card

Answer

The smart card driver is outdated

Answer

The workstation's clock is off by more than 5 minutes

Question 8

An organization is implementing a privileged access management (PAM) solution for managing administrative credentials. Which of the following is the most critical control to prevent credential theft?

Accepted Answer

Just-in-time (JIT) privilege elevation. Option A is correct because just-in-time privilege elevation minimizes the window of exposure and reduces standing privileges, which is the most effective against credential theft. Option B is wrong because multi-factor authentication is important but does not prevent theft of cached credentials. Option C is wrong because password rotation is reactive. Option D is wrong because session recording is detective. Option E is wrong because encryption protects at rest but does not prevent theft in use.

Answer

Enforcing periodic password changes

Answer

Encrypting stored passwords

Answer

Multi-factor authentication on admin accounts

Answer

Session recording and monitoring

Question 9

An auditor finds that a system uses the same service account for multiple applications. Which risk does this pose?

Accepted Answer

Inability to rotate passwords without affecting all applications. Option B is correct because changing the password of the shared service account would break all applications that depend on it without coordinated effort. Option A is wrong because there is only one account, not multiple. Option C is wrong because single point of failure is about availability, not credential management. Option D is wrong because it does not increase attack surface directly. Option E is wrong because it simplifies management but introduces risk.

Answer

Increased attack surface due to multiple passwords

Answer

Difficulty in auditing because all applications share one account

Answer

Single point of failure for authentication

Question 10

When implementing a federated identity management system, which TWO components are essential for establishing trust between Identity Provider and Service Provider? (Select two.)

Accepted Answer

Metadata exchange. Metadata exchange is essential because it allows the Identity Provider (IdP) and Service Provider (SP) to share configuration details such as endpoints, supported SAML bindings, and entity identifiers. This automated exchange establishes the initial trust relationship by ensuring both parties have accurate, verifiable information about each other before any authentication requests occur.

Answer

User directory synchronization

Answer

Single logout

Answer

Shared secret

Question 11

Which TWO of the following are considered the primary access control models in the context of the CISSP? (Select two.)

Accepted Answer

Mandatory Access Control (MAC). Mandatory Access Control (MAC) is a primary access control model where access decisions are based on fixed security labels (e.g., classification levels like Top Secret, Secret, Confidential) assigned to subjects and objects by a central authority. The system enforces these labels, and users cannot override them, making it a core model for high-security environments such as military or government systems. In the CISSP context, MAC and DAC are traditionally considered the two foundational models, with RBAC and ABAC often treated as extensions or implementations of DAC.

Answer

Role-Based Access Control (RBAC)

Answer

Attribute-Based Access Control (ABAC)

Answer

Risk-Based Access Control

Question 12

A security analyst is reviewing an organization's password policy. Which THREE of the following are considered best practices for password security according to current NIST guidelines? (Select three.)

Accepted Answer

Enforce password history of 10. Option A is correct because NIST SP 800-63B recommends enforcing a password history to prevent users from reusing recent passwords, with a typical value of 10-24 previous passwords. This reduces the risk of password recycling attacks where compromised credentials are reused. Option D is correct because multi-factor authentication (MFA) is a core NIST recommendation to add an additional layer of security beyond passwords, mitigating credential theft. Option E is correct because NIST now advises a minimum password length of 8 characters (or more) as a primary defense against brute-force attacks, rather than relying on complexity rules.

Answer

Require password changes every 30 days

Answer

Allow password hints

Question 13

Refer to the exhibit. An organization attaches this IAM policy to a user. What is a key security limitation of this policy?

Accepted Answer

It only allows the GetObject action, limiting functionality. Option A is correct because the policy only grants the s3:GetObject action, which restricts the user to read-only access on S3 objects. This is a key security limitation as it prevents the user from performing other necessary operations like listing buckets (s3:ListBucket) or writing data, which can hinder operational workflows. The policy's narrow scope ensures least privilege but may be too restrictive for roles requiring broader S3 interactions.

Answer

It does not specify a Principal, so access is denied for all

Answer

It allows all actions except s3:GetObject

Answer

It allows access from any IP within the 10.0.0.0/8 range, which is too broad

Question 14

Refer to the exhibit. A user has obtained a Kerberos ticket. What does the presence of two service principals indicate?

Accepted Answer

The user has been issued a Ticket-Granting Ticket and a service ticket. In Kerberos, a Ticket-Granting Ticket (TGT) is issued after initial authentication and is used to request service tickets for specific services. The presence of two service principals in a user's Kerberos ticket cache indicates that the user has both a TGT (identified by the krbtgt service principal) and a service ticket (identified by the target service's principal). This is the normal and expected state after a user has authenticated and then requested access to a service.

Answer

The KDC is misconfigured

Answer

The user has authenticated to two different services

Answer

The user's credentials have been compromised

Question 15

Refer to the exhibit. The PAM configuration shows pam_tally2.so with deny=5 and unlock_time=300. What is the effect of this configuration?

Accepted Answer

Users are locked out after 5 failed login attempts, and automatically unlocked after 5 minutes. Option C is correct because pam_tally2.so with deny=5 locks the user account after 5 failed authentication attempts, and unlock_time=300 sets the automatic unlock period to 300 seconds (5 minutes). This is a standard PAM (Pluggable Authentication Modules) configuration for account lockout policies, commonly used on Linux systems to mitigate brute-force attacks.

Answer

The account is disabled after 5 successful logins

Answer

Passwords must be changed every 5 days

Answer

Users are locked out after 5 failed attempts until manually unlocked