CISSP Identity and Access Management Practice Test 4 — 15 Questions

Question 1

A user calls the help desk because they cannot log in. The help desk technician confirms the user's identity by asking for their employee ID and mother's maiden name. Which of the following is the MOST significant security issue with this practice?

Accepted Answer

The technician is using shared secrets that are not effective for strong authentication.. Option A is correct because relying on shared secrets like mother's maiden name is weak authentication. Option B is incorrect because the information may be unique but is not secret. Option C is incorrect, while MFA is better, the most significant issue is the use of weak shared secrets. Option D is incorrect; the information may still be stored.

Answer

The user's mother's maiden name is not stored in the HR system.

Answer

The help desk should be using multi-factor authentication.

Answer

The user's identity is being verified using information that is not unique to the user.

Question 2

A company is implementing single sign-on (SSO) for its cloud applications. The security team wants to ensure that user authentication is handled by an on-premises identity provider (IdP) using Security Assertion Markup Language (SAML). Which of the following is a critical configuration step to prevent session hijacking?

Accepted Answer

Validate the Issuer element in the SAML response.. Option D is correct because validating the Issuer element in the SAML response ensures that the response originated from the trusted on-premises identity provider (IdP) and not from an attacker impersonating the IdP. Without this validation, an attacker could forge a SAML response with a manipulated Issuer value, leading to session hijacking or unauthorized access. This is a fundamental SAML security check specified in the SAML 2.0 core specification (section 3.3.4).

Answer

Use HTTP POST binding instead of HTTP Redirect binding.

Answer

Set a short timeout for the SAML authentication request.

Answer

Encrypt the SAML assertions using the service provider's public key.

Question 3

An organization uses a role-based access control (RBAC) model. After an audit, it was discovered that users have accumulated excessive permissions due to role proliferation. The security architect proposes migrating to an attribute-based access control (ABAC) model. Which challenge is MOST likely to be encountered during this migration?

Accepted Answer

Increased complexity in defining and managing attributes.. Option D is correct because migrating from RBAC to ABAC requires defining a comprehensive set of attributes (subject, resource, environment) and the policies that combine them, which is inherently more complex than managing static role assignments. Role proliferation in RBAC often results from an attempt to mimic attribute-based decisions, but ABAC shifts the complexity from role engineering to attribute governance and policy logic, making attribute definition and management the primary challenge.

Answer

Difficulty in assigning roles to users.

Answer

Reduced performance due to policy evaluation overhead.

Answer

Lack of support for ABAC in legacy applications.

Question 4

A system administrator is configuring an LDAP directory for user authentication. The policy requires that account lockout occurs after a specified number of failed attempts. Which attribute should be configured?

Accepted Answer

lockoutThreshold. The `lockoutThreshold` attribute in an LDAP directory specifies the maximum number of consecutive failed authentication attempts allowed before the account is locked. This directly satisfies the policy requirement to lock the account after a specified number of failed attempts, making it the correct attribute to configure.

Answer

failedLoginAttempts

Answer

lockoutDuration

Answer

passwordLockoutTime

Question 5

A security engineer is troubleshooting an issue where users are unable to access a web application after being authenticated via OAuth 2.0. The users receive a 403 Forbidden error. The application logs show that the access token is valid but does not contain the required scope. What is the most likely cause?

Accepted Answer

The authorization server did not grant the requested scope due to user consent settings.. The 403 Forbidden error indicates the resource server received a valid access token but denied access because the token lacks the necessary scope. In OAuth 2.0, the authorization server issues tokens based on the scope granted by the user during consent. If the user did not consent to the required scope (e.g., 'write' instead of 'read'), the token will not include it, causing the resource server to reject the request despite the token being valid.

Answer

The resource server is configured to expect a different token type.

Answer

The client application is not using HTTPS to transmit the token.

Answer

The access token expired before being presented to the resource server.

Question 6

An organization uses a federated identity model with multiple external partners. The identity provider (IdP) notices that some partners are sending outdated SAML assertions. What is the best way to mitigate this issue?

Accepted Answer

Configure the IdP to reject assertions with a stale timestamp using the Conditions element.. Option C is correct because the SAML Conditions element explicitly defines the validity window for an assertion using NotBefore and NotOnOrAfter attributes. By configuring the IdP to validate these timestamps and reject assertions that fall outside the window, the organization directly enforces assertion freshness without relying on partner-side changes or weakening security.

Answer

Require partners to include a timestamp in the assertion.

Answer

Increase the NotBefore and NotOnOrAfter time window.

Answer

Implement short-lived assertions and require re-authentication.

Question 7

A company's help desk receives many requests from users who have forgotten their passwords. Which solution is MOST effective in reducing these requests while maintaining security?

Accepted Answer

Implement a self-service password reset (SSPR) with identity verification.. Self-service password reset (SSPR) with identity verification directly addresses the root cause of help desk calls—forgotten passwords—by allowing users to reset their own passwords after proving their identity via pre-registered methods (e.g., SMS, security questions, or biometrics). This reduces operational overhead while maintaining security through multi-factor verification and policy enforcement, unlike options that weaken security or fail to address the frequency of resets.

Answer

Increase the password expiration period to 180 days.

Answer

Use single sign-on for all applications.

Answer

Reduce the password complexity requirements.

Question 8

During a security assessment, it is found that service accounts have interactive logon rights. What is the BEST remediation?

Accepted Answer

Use managed service accounts instead.. Managed Service Accounts (MSAs) are the best remediation because they are designed specifically for service accounts, automatically manage password changes, and by default have no interactive logon rights. This eliminates the security risk of interactive logon while also addressing password management and reducing administrative overhead. Group Policy changes or manual password policies do not address the underlying architectural issue of using a standard user account for a service.

Answer

Implement Group Policy to deny interactive logon for service accounts.

Answer

Ensure service accounts use strong passwords.

Answer

Remove service accounts from the local Administrators group.

Question 9

A company is designing an access control system for a highly sensitive database. They want to ensure that only authorized users can access data, and that access is automatically revoked when the user's context changes (e.g., job role change). Which model BEST meets these requirements?

Accepted Answer

Attribute-based access control (ABAC) with dynamic policy evaluation.. ABAC with dynamic policy evaluation is the best fit because it uses attributes (user, resource, environment) to make real-time access decisions. This allows access to be automatically revoked when context changes, such as a job role update, without manual intervention or periodic reviews.

Answer

Discretionary access control (DAC) with access control lists.

Answer

Role-based access control (RBAC) with periodic reviews.

Answer

Mandatory access control (MAC) with security labels.

Question 10

Which TWO are examples of 'something you know' authentication factors?

Accepted Answer

PIN. A PIN is a classic 'something you know' authentication factor because it relies on a secret value stored in the user's memory. Unlike biometric or possession-based factors, a PIN does not require any physical token or biological trait—only the recall of the correct numeric sequence. This aligns with the core definition of knowledge-based authentication (KBA) in IAM.

Answer

Retina scan

Answer

Fingerprint

Answer

Smart card

Question 11

Which TWO are security benefits of using a federated identity model?

Accepted Answer

Simplified user management across organizations. Option A is correct because federated identity models allow organizations to trust identities issued by other members of the federation, eliminating the need for separate user accounts and enabling simplified user management across organizational boundaries. This is achieved through standards like SAML 2.0 or OpenID Connect, where identity assertions are exchanged between identity providers (IdPs) and service providers (SPs) without duplicating user directories.

Answer

Elimination of password policies

Answer

Reduced risk of credential theft

Answer

Single point of failure for authentication

Question 12

Which THREE are components of a privileged access management (PAM) solution?

Accepted Answer

Credential vaulting. Credential vaulting is a core component of PAM because it securely stores privileged account credentials (e.g., root, admin, service accounts) in an encrypted repository, often using hardware security modules (HSMs) or strong encryption like AES-256. It enforces strict access controls, rotation policies, and checkout/check-in workflows to prevent credential exposure and misuse.

Answer

Password complexity rules

Answer

Multi-factor authentication for all users

Question 13

Refer to the exhibit. A user in the 10.1.0.0/16 range attempts to retrieve the object s3://example-bucket/secret/top_secret.pdf. What will be the result?

Accepted Answer

The request is denied because the condition in the first statement does not match the IP range.. Option D is correct because the first statement in the policy has a condition that restricts access to requests originating from the IP range 10.2.0.0/16. Since the user is in the 10.1.0.0/16 range, the condition is not satisfied, so the first statement does not apply. Without an explicit Allow that matches the request, the default implicit Deny takes effect, resulting in the request being denied.

Answer

The request is denied because the first statement allows but the second denies.

Answer

The request is allowed because the Deny statement only applies to the secret prefix, and the IP condition is satisfied for the user in 10.1.0.0/16.

Answer

The request is allowed because the first statement matches and allows.

Question 14

Refer to the exhibit. A user is unable to authenticate using Kerberos. What is the most likely cause?

Accepted Answer

The client's system clock is not synchronized with the domain controller.. Kerberos relies heavily on time synchronization between the client and the Key Distribution Center (KDC) because it uses timestamps to prevent replay attacks. If the client's system clock differs from the domain controller's clock by more than the default maximum tolerance (typically 5 minutes in Windows Active Directory), the KDC will reject the authentication request, resulting in failure. This is the most likely cause because the user is unable to authenticate at all, not just after a period of inactivity.

Answer

The Kerberos ticket-granting ticket (TGT) has expired.

Answer

The user's account is locked out.

Answer

The user's password has expired.

Question 15

A financial services company with 5000 employees uses a hybrid identity model with on-premises Active Directory (AD) synchronized to Azure AD via Azure AD Connect. The company has recently deployed Microsoft 365 and uses it for email and file sharing. Users authenticate to Azure AD using password hash synchronization (PHS) with Seamless Single Sign-On (SSO). The security team has implemented Conditional Access policies to require multi-factor authentication (MFA) for all external access and for access to sensitive financial applications. Recently, the help desk has received numerous complaints from users working remotely that they are frequently prompted for MFA, even multiple times during a single work session, causing frustration and productivity loss. Additionally, some users report that they are unable to access certain financial applications despite being in the correct group membership. An investigation reveals that Azure AD Connect synchronization is occurring successfully and that MFA configurations appear correct. The security team suspects that the issue may be related to the Conditional Access session settings or token lifetimes. What is the BEST course of action to diagnose and resolve the primary issue of excessive MFA prompts while maintaining security?

Accepted Answer

Review the Conditional Access policy for the financial applications to ensure that the 'Session' controls are configured to 'Use app enforced restrictions' and adjust MFA trust settings.. Option C is correct because the issue of excessive MFA prompts while maintaining security is best resolved by reviewing the Conditional Access session controls. Specifically, the 'Sign-in frequency' and 'Persistent browser session' settings in the session controls determine how often users are re-prompted for MFA. By adjusting these settings (e.g., setting sign-in frequency to a longer duration like 24 hours) and ensuring MFA trust settings are configured to allow trusted devices or locations, the security team can reduce unnecessary prompts without weakening security. This directly addresses the user complaints while keeping Conditional Access policies intact.

Answer

Implement a privileged identity management (PIM) solution to manage access to the financial applications.

Answer

Increase the sign-in frequency and session timeout values in the Conditional Access policies for all users to 24 hours.

Answer

Disable Seamless SSO and require users to enter passwords each time to ensure token freshness.