ISC Identity And Access Management Architecture — 20 Questions

Question 1

In a SAML 2.0 federation architecture, the Service Provider (SP) returns a 403 error during the assertion consumption phase. After verifying the digital signature, what is the most likely cause?

Accepted Answer

Subject NameID mismatch. If the signature is valid but access is denied, the NameID or attributes in the assertion often do not match the expected user mapping or authorization requirements at the SP.

Answer

Encryption algorithm mismatch

Answer

Expired metadata

Answer

Assertion Consumer Service (ACS) URL mismatch

Question 2

You are implementing Zero Trust Network Access (ZTNA) using Zscaler Private Access (ZPA). Which component is responsible for the actual interception and brokering of the connection between the user and the private application?

Accepted Answer

Zscaler Cloud Broker. The Zscaler App Connector initiates an outbound-only connection to the Zscaler cloud, where the ZPA broker connects the user to the application without exposing the application to the internet.

Answer

Zscaler Client Connector

Answer

Zscaler App Connector

Answer

Zscaler Central Authority

Question 3

When deploying HashiCorp Vault for secrets management, you need to implement a 'Dynamic Secrets' architecture for database access. Which workflow is correct?

Accepted Answer

Vault requests a new user creation from the DB via a configured engine and returns those credentials to the client.. The dynamic secret workflow involves Vault generating unique, short-lived database credentials on-the-fly for every request, which are automatically revoked upon expiry.

Answer

Clients authenticate to the DB via Vault using LDAP delegation.

Answer

Vault retrieves static credentials from a PKI backend and rotates them.

Answer

Vault hashes existing database passwords and stores them in transit.

Question 4

In a Zero Trust architecture, what is the primary role of a Policy Decision Point (PDP)?

Accepted Answer

To evaluate access requests against defined security policies.. The PDP is the architectural component that evaluates requests against predefined policies and returns an allow or deny decision to the Policy Enforcement Point (PEP).

Answer

To manage user identities in the directory.

Answer

To log all access attempts for compliance.

Answer

To intercept and inspect network packets.

Question 5

When designing a privileged access management (PAM) solution using CyberArk, you must ensure that privileged credentials are never exposed to the end-user workstation. Which feature facilitates this?

Accepted Answer

CyberArk PSM (Privileged Session Manager). CyberArk PSM (Privileged Session Manager) provides an isolated 'jump' environment where the session is proxied, keeping the actual target credentials hidden from the end-user.

Answer

CyberArk AIM (Application Identity Manager)

Answer

CyberArk EPM (Endpoint Privilege Manager)

Answer

CyberArk Vault Agent

Question 6

You are configuring an AWS IAM Identity Center (successor to AWS SSO) environment. You need to provide temporary, elevated access to a developer for a specific account. Which mechanism provides the most granular architectural approach for this?

Accepted Answer

Permission Sets. AWS IAM Identity Center Permission Sets allow you to define granular access scoped to specific accounts, which can be assigned to users on-demand or via group membership.

Answer

IAM User Inline Policies

Answer

Cross-account IAM Roles

Answer

IAM User Access Keys

Question 7

You are deploying OIDC (OpenID Connect) for a web application. You need to prevent token replay attacks. Which claim should the application validate in the ID Token?

Accepted Answer

nonce. The 'nonce' claim is a cryptographically strong value that links the request to the response, allowing the client to verify that the ID Token was generated specifically for its request.

Answer

iss

Answer

iat

Answer

sub

Question 8

You are designing an Azure AD (Entra ID) Conditional Access policy to restrict access to sensitive applications. You need to ensure that only compliant, managed devices can access the resource. Which Grant control must be configured?

Accepted Answer

Require device to be marked as compliant. The 'Require device to be marked as compliant' control enforces that the device must be registered in Intune and meet all defined compliance policies before access is granted.

Answer

Require password change

Answer

Require approved client app

Answer

Require hybrid Azure AD joined device

Question 9

You are architecting a solution to mitigate 'Token Theft' in a Zero Trust environment. Which mechanism binds a token to a specific client instance?

Accepted Answer

DPoP (Demonstrating Proof-of-Possession). DPoP (Demonstrating Proof-of-Possession) binds tokens to a private key held by the client, ensuring that even if a token is stolen, it cannot be used without the accompanying private key.

Answer

PKCE (Proof Key for Code Exchange)

Answer

Refresh Token Rotation

Answer

MFA step-up

Question 10

Which protocol is the industry standard for automating the exchange of user identity information between an Identity Provider and a Service Provider?

Accepted Answer

SCIM. SCIM (System for Cross-domain Identity Management) is the standard designed to facilitate the exchange of user identity information between systems.

Answer

RADIUS

Answer

SAML

Answer

LDAP

Question 11

When implementing FIDO2/WebAuthn for passwordless authentication, where does the private key reside?

Accepted Answer

On the user's local hardware authenticator.. In FIDO2, the private key is stored securely on the local authenticator (e.g., TPM, Secure Enclave, or hardware security key) and never leaves the device.

Answer

In the Identity Provider's database.

Answer

In the browser's encrypted cache.

Answer

In the server-side hardware security module (HSM).

Question 12

You are auditing an OAuth 2.0 implementation. You discover that the application uses the 'Implicit Grant' flow. Why is this considered an architectural security weakness?

Accepted Answer

It exposes access tokens in the browser URL.. The Implicit Grant returns access tokens directly in the URL fragment, which is susceptible to browser history leaks, referrer header exposure, and interception via malicious extensions.

Answer

It requires the client secret to be stored on the client side.

Answer

It relies on symmetric encryption for all token exchanges.

Answer

It does not support refresh tokens, limiting usability.

Question 13

In a cloud architecture, what does the 'Principle of Least Privilege' (PoLP) imply regarding IAM roles?

Accepted Answer

Permissions should be granted based on the user's job role and the specific resources needed.. PoLP requires that identities are granted only the minimum permissions necessary to perform their assigned task, for the minimum duration required.

Answer

All users should have read access to the root directory.

Answer

Administrators should have full control over all cloud resources.

Answer

Roles should be static and never changed to ensure stability.

Question 14

What is the primary architectural purpose of implementing Just-in-Time (JIT) access?

Accepted Answer

To minimize the window of opportunity for attackers to exploit standing privileges.. JIT access reduces the attack surface by ensuring that high-privilege access is only active when needed, rather than remaining persistent.

Answer

To eliminate the need for an identity provider.

Answer

To increase user productivity by removing MFA requirements.

Answer

To automate user provisioning and deprovisioning.

Question 15

You are implementing an IdP-initiated SSO flow. What is the primary architectural requirement for the SP?

Accepted Answer

The SP must have a pre-configured trust relationship with the IdP's metadata.. The SP must be configured to receive and validate the unsolicited SAML assertion sent by the IdP to the assertion consumer service (ACS) endpoint.

Answer

The SP must utilize LDAP over SSL for the assertion.

Answer

The SP must redirect the user to the IdP login page.

Answer

The SP must poll the IdP for a login event.

Question 16

What is the purpose of 'Claims Transformation' in an Identity Provider?

Accepted Answer

To convert user attributes from one format to another.. Claims transformation allows the IdP to map or modify attributes from a source directory (like AD) into a format expected by the target application (SAML/OIDC).

Answer

To encrypt the entire user session.

Answer

To authenticate users against multiple directories simultaneously.

Answer

To store authentication logs in a central repository.

Question 17

Which authentication factor is considered 'inherence'?

Accepted Answer

A fingerprint scan.. Inherence factors are based on something the user is, such as biometrics (fingerprint, iris scan, facial recognition).

Answer

A strong passphrase.

Answer

A one-time password (OTP).

Answer

A hardware security key.

Question 18

You are securing a microservices architecture using mTLS. Which party is responsible for issuing the certificates that identify each service?

Accepted Answer

Internal Certificate Authority (CA). A Private Certificate Authority (CA) or a Service Mesh (like Istio) acting as a CA is responsible for issuing and rotating certificates for service-to-service authentication.

Answer

The API Gateway

Answer

The Load Balancer

Answer

The Identity Provider (IdP)

Question 19

In the context of the OAuth 2.0 Authorization Code flow, why is the 'client_secret' never sent to the user's browser?

Accepted Answer

Because it must be kept confidential on the backend server.. The client secret is a shared secret between the Authorization Server and the application. If exposed to the browser, it can be easily extracted and used by attackers to impersonate the client.

Answer

Because the client secret is only used for PKCE.

Answer

Because the browser does not support SSL.

Answer

Because browsers block outbound requests with secrets.

Question 20

What is the primary function of an 'Identity Bridge' in a hybrid architecture?

Accepted Answer

To federate identity between on-premises and cloud environments.. An identity bridge connects disparate identity systems (e.g., on-premises AD and cloud-based IdP) to provide a unified authentication experience.

Answer

To store user passwords in a central vault.

Answer

To enforce network firewall rules.

Answer

To perform real-time user activity monitoring.