CISSP Identity and Access Management — Timed 10 Questions

Question 1

A healthcare organization implements a policy requiring all employees to use biometric fingerprint scanners to access patient records. Which of the following is the MOST significant risk associated with this authentication method?

Accepted Answer

Biometric data cannot be revoked or changed if compromised. Biometric data, such as fingerprint templates, is immutable and permanently tied to the individual. Once compromised, the user cannot simply 'reset' their fingerprint like a password, rendering the authentication factor permanently insecure for that user across all systems where it is used. This non-repudiation and revocation failure represents the most significant long-term risk to the organization's identity management infrastructure.

Answer

High false acceptance rate leading to unauthorized access

Answer

Low user acceptance due to privacy concerns

Answer

Increased login time compared to password authentication

Question 2

A multinational corporation deploys a single sign-on (SSO) solution using SAML 2.0 across all subsidiaries. Recently, users in one subsidiary report being unable to access an internal application. The identity provider (IdP) logs show successful authentication, but the service provider (SP) logs indicate assertion validation failures. Which of the following is the MOST likely cause?

Accepted Answer

The system clocks on the IdP and SP are significantly out of sync. SAML 2.0 relies on timestamps (NotBefore and NotOnOrAfter) within the assertion for validity. If the system clocks on the identity provider (IdP) and service provider (SP) are significantly out of sync, the SP will reject the assertion as expired or not yet valid, even though the IdP logs show successful authentication. This is the most common cause of assertion validation failures in cross-domain SSO deployments.

Answer

The SP is configured to require a specific SAML attribute not present in the assertion

Answer

The IdP server for the subsidiary is temporarily unreachable

Answer

The SAML certificate used by the SP has expired

Question 3

An organization wants to implement a password policy that balances security and usability. Which of the following is the BEST practice according to current NIST guidelines?

Accepted Answer

Compare new passwords against a list of known compromised passwords. NIST SP 800-63B explicitly recommends checking passwords against a list of known compromised passwords (e.g., from previous breaches) rather than enforcing arbitrary complexity rules. This approach directly mitigates credential stuffing and dictionary attacks by rejecting passwords that have already been exposed, while avoiding user frustration from frequent changes or complex composition requirements.

Answer

Set maximum password length to 8 characters

Answer

Require password changes every 30 days

Answer

Enforce a minimum of one uppercase, one lowercase, one digit, and one special character

Question 4

A company uses Role-Based Access Control (RBAC) for its ERP system. A user in the 'Accounts Payable' role needs to temporarily approve purchase orders up to $10,000 while the 'Purchasing Manager' is on leave. What is the BEST way to grant this access?

Accepted Answer

Temporarily assign the 'Purchasing Approver' role to the user with an expiration date. Option B is correct because it follows the principle of least privilege by temporarily assigning the 'Purchasing Approver' role to the user with an expiration date, ensuring that the elevated permissions are automatically revoked after the leave period. This approach maintains RBAC integrity without permanently altering role definitions or sharing credentials.

Answer

Share the Purchasing Manager's account credentials with the user

Answer

Modify the 'Accounts Payable' role to include purchase order approval permissions

Answer

Create a new role with the exact permissions needed and assign it to the user

Question 5

A security analyst discovers that a service account in Active Directory has not had its password changed in 5 years and has domain admin privileges. The account is used by a legacy application that does not support modern authentication protocols. Which of the following is the MOST secure approach to manage this account?

Accepted Answer

Decommission the legacy application and migrate to a modern alternative that supports secure authentication. Option D is correct because the best security is to decommission the account and modernize the application. Option A is wrong because group Managed Service Accounts (gMSAs) require Windows Server 2012 or later and application support. Option B is wrong because a long, complex password still has risk of theft and is not automatically rotated. Option C is wrong because disabling the account would break the application.

Answer

Convert the account to a group Managed Service Account (gMSA)

Answer

Set a very long, complex password and store it in a password manager

Answer

Disable the account and create a new service account with limited privileges

Question 6

A company wants to implement multi-factor authentication (MFA) for remote access. Which combination of factors represents something you have and something you are?

Accepted Answer

Smart card and fingerprint. Option C is correct because a smart card is a physical device that you possess (something you have), and a fingerprint is a biometric characteristic unique to you (something you are). This combination satisfies the multi-factor authentication requirement by using two distinct factors from different categories, which is more secure than using two factors from the same category.

Answer

Password and PIN

Answer

Hardware token and mobile phone

Answer

Password and SMS code

Question 7

An organization uses OAuth 2.0 for delegated access to APIs. A developer creates a public client application that runs on mobile devices. Which OAuth 2.0 grant type is MOST appropriate for this scenario?

Accepted Answer

Authorization Code Grant with PKCE. The Authorization Code Grant with PKCE (Proof Key for Code Exchange) is the most appropriate for a public client on a mobile device because it prevents authorization code interception attacks. PKCE replaces the client secret with a dynamically generated code verifier and challenge, ensuring that even if the authorization code is intercepted, it cannot be exchanged for tokens without the original verifier. This is the OAuth 2.0 Security Best Current Practice (BCP) recommendation for native and mobile apps.

Answer

Client Credentials Grant

Answer

Implicit Grant

Answer

Resource Owner Password Credentials Grant

Question 8

Which TWO of the following are valid methods to enforce separation of duties in an access control system?

Accepted Answer

Using time-based restrictions to prevent overlapping tasks. Time-based restrictions enforce separation of duties by preventing a single user from performing conflicting tasks during overlapping time periods. For example, a user authorized to initiate a payment transaction cannot also approve it within the same time window, ensuring that no single individual has end-to-end control over a sensitive process. This is a technical control that directly supports the principle of separation of duties in an access control system.

Answer

Requiring mandatory vacations for all employees

Answer

Performing job rotation every six months

Answer

Configuring shared accounts for each department

Question 9

Which THREE of the following are characteristics of a federated identity management system?

Accepted Answer

It relies on standard protocols such as SAML or OpenID Connect. Option A is correct because federated identity management systems rely on standard protocols like SAML (Security Assertion Markup Language) or OpenID Connect to exchange authentication and authorization data between identity providers (IdPs) and service providers (SPs). These protocols enable trust relationships across different security domains without requiring shared directories or a single IdP.

Answer

It operates with a single identity provider for all organizations

Answer

It requires all participating organizations to use the same user directory

Question 10

Which TWO of the following are types of access control models?

Accepted Answer

Discretionary Access Control (DAC). Discretionary Access Control (DAC) is an access control model where the owner of a resource (e.g., a file or object) has the authority to grant or deny access to other subjects. This is typically implemented using Access Control Lists (ACLs) on objects, allowing the owner to set permissions (e.g., read, write, execute) for specific users or groups. DAC is defined in the Trusted Computer System Evaluation Criteria (TCSEC) as a fundamental model for controlling access based on the identity of subjects and/or the groups to which they belong.

Answer

SAML

Answer

Kerberos

Answer

LDAP