20+ practice questions focused on Identity and Access Management — one of the most tested topics on the Certified Information Systems Security Professional CISSP exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Identity and Access Management PracticeWhich statement about SAML 2.0 is correct?
Explanation: SAML 2.0 (specifically the Web Browser SSO Profile) relies on the user's browser to redirect the user-agent between the Service Provider (SP) and the Identity Provider (IdP) using bindings such as HTTP Redirect or HTTP POST. SAML uses XML (not JSON) for its assertions, supports both IdP-initiated and SP-initiated SSO flows, and is primarily designed for federated authentication (identity assertion) rather than fine-grained authorization.
An organization is implementing Privileged Access Management (PAM). Which THREE of the following are common features of a PAM solution? (Select THREE)
Explanation: Common PAM features include password vaulting, just-in-time (JIT) access, and session recording/monitoring. Single Sign-On (SSO) and self-service password reset (SSPR) are general Identity and Access Management (IAM) features rather than core Privileged Access Management (PAM) capabilities.
A company implements a policy requiring two different employees to approve a payment transaction. This is an example of:
Explanation: Separation of duties (SoD) prevents fraud by ensuring that a single person cannot initiate and complete a critical transaction alone. By requiring one employee to initiate the payment and another to approve it, the process is split, mitigating the risk of collusion and unauthorized transactions.
An organization uses Active Directory and needs to enforce password complexity settings for all users in a specific department. What is the most efficient way to achieve this?
Explanation: In Active Directory, standard domain password policies can only be set at the domain level (typically via the Default Domain Policy). Linking a GPO to an OU to change password settings for domain users in that OU does not work; it only affects local accounts on the computers inside that OU. To enforce different password complexity settings for a specific department, you must use Fine-Grained Password Policies (FGPP) by creating a Password Settings Object (PSO) and applying it to a global security group containing the department's users.
Which of the following access control models allows the data owner to decide who can access their resources?
Explanation: Discretionary Access Control (DAC) is the correct answer because it allows the data owner (the creator or custodian of the resource) to decide who can access their resources and at what privilege level. In DAC, access rights are assigned based on the owner's discretion, typically using Access Control Lists (ACLs) or owner-based permissions, as seen in file systems like NTFS or UNIX chmod.
+15 more Identity and Access Management questions available
Practice all Identity and Access Management questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Identity and Access Management. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Identity and Access Management questions on the CISSP frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Identity and Access Management is tested as part of the Certified Information Systems Security Professional CISSP blueprint. Practicing with targeted Identity and Access Management questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free CISSP practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Identity and Access Management is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Identity and Access Management practice session with instant scoring and detailed explanations.
Start Identity and Access Management Practice →