ISC Identity And Access Management Architecture — All Questions With Answers

Question 1mediummultiple choice

Read the full Identity And Access Management Architecture explanation →

In a SAML 2.0 federation architecture, the Service Provider (SP) returns a 403 error during the assertion consumption phase. After verifying the digital signature, what is the most likely cause?

Question 2mediummultiple choice

Read the full Identity And Access Management Architecture explanation →

You are implementing Zero Trust Network Access (ZTNA) using Zscaler Private Access (ZPA). Which component is responsible for the actual interception and brokering of the connection between the user and the private application?

Question 3hardmultiple choice

Read the full Identity And Access Management Architecture explanation →

When deploying HashiCorp Vault for secrets management, you need to implement a 'Dynamic Secrets' architecture for database access. Which workflow is correct?

Question 4mediummultiple choice

Read the full Identity And Access Management Architecture explanation →

Which protocol is the industry standard for automating the exchange of user identity information between an Identity Provider and a Service Provider?

Question 5hardmultiple choice

Read the full Identity And Access Management Architecture explanation →

You are auditing an OAuth 2.0 implementation. You discover that the application uses the 'Implicit Grant' flow. Why is this considered an architectural security weakness?

Question 6hardmultiple choice

Read the full Identity And Access Management Architecture explanation →

You are configuring an AWS IAM policy to allow a user to list S3 buckets only if they are connected from a specific IP range. Which policy element is required?

Question 7hardmulti select

Read the full Identity And Access Management Architecture explanation →

Which TWO risks are significantly mitigated by implementing a Privileged Access Management (PAM) vault?

Question 8mediummulti select

Read the full Identity And Access Management Architecture explanation →

Which TWO concepts are central to 'Federated Identity'?

Question 9hardmulti select

Read the full Identity And Access Management Architecture explanation →

Which THREE mechanisms are commonly used to secure the 'Authorization Code' in an OAuth 2.0 flow?

Question 10mediummultiple choice

Read the full Identity And Access Management Architecture explanation →

An architect is designing an OAuth 2.0 implementation for a mobile application. To prevent authorization code injection attacks, which specific configuration must be enforced in the client registration?

Question 11mediummultiple choice

Read the full Identity And Access Management Architecture explanation →

In a Zero Trust architecture, what is the primary role of a Policy Decision Point (PDP)?

Question 12mediummultiple choice

Read the full Identity And Access Management Architecture explanation →

When designing a privileged access management (PAM) solution using CyberArk, you must ensure that privileged credentials are never exposed to the end-user workstation. Which feature facilitates this?

Question 13hardmultiple choice

Read the full Identity And Access Management Architecture explanation →

You are configuring an AWS IAM Identity Center (successor to AWS SSO) environment. You need to provide temporary, elevated access to a developer for a specific account. Which mechanism provides the most granular architectural approach for this?

Question 14hardmultiple choice

Read the full Identity And Access Management Architecture explanation →

You are deploying OIDC (OpenID Connect) for a web application. You need to prevent token replay attacks. Which claim should the application validate in the ID Token?

Question 15mediummultiple choice

Read the full Identity And Access Management Architecture explanation →

You are designing an Azure AD (Entra ID) Conditional Access policy to restrict access to sensitive applications. You need to ensure that only compliant, managed devices can access the resource. Which Grant control must be configured?

Question 16hardmultiple choice

Read the full Identity And Access Management Architecture explanation →

You are architecting a solution to mitigate 'Token Theft' in a Zero Trust environment. Which mechanism binds a token to a specific client instance?

Question 17mediummultiple choice

Read the full Identity And Access Management Architecture explanation →

When implementing FIDO2/WebAuthn for passwordless authentication, where does the private key reside?

Question 18easymultiple choice

Read the full Identity And Access Management Architecture explanation →

In a cloud architecture, what does the 'Principle of Least Privilege' (PoLP) imply regarding IAM roles?

Question 19easymultiple choice

Read the full Identity And Access Management Architecture explanation →

What is the primary architectural purpose of implementing Just-in-Time (JIT) access?

Question 20mediummultiple choice

Read the full Identity And Access Management Architecture explanation →

You are implementing an IdP-initiated SSO flow. What is the primary architectural requirement for the SP?

Question 21mediummultiple choice

Read the full Identity And Access Management Architecture explanation →

What is the purpose of 'Claims Transformation' in an Identity Provider?

Question 22easymultiple choice

Read the full Identity And Access Management Architecture explanation →

Which authentication factor is considered 'inherence'?

Question 23hardmultiple choice

Read the full Identity And Access Management Architecture explanation →

You are securing a microservices architecture using mTLS. Which party is responsible for issuing the certificates that identify each service?

Question 24mediummultiple choice

Read the full Identity And Access Management Architecture explanation →

In the context of the OAuth 2.0 Authorization Code flow, why is the 'client_secret' never sent to the user's browser?

Question 25mediummultiple choice

Read the full Identity And Access Management Architecture explanation →

What is the primary function of an 'Identity Bridge' in a hybrid architecture?

Question 26mediummultiple choice

Read the full Identity And Access Management Architecture explanation →

What is the benefit of using 'Scoped Access Tokens' in an OAuth architecture?

Question 27hardmultiple choice

Read the full Identity And Access Management Architecture explanation →

When using an API Gateway as a Policy Enforcement Point (PEP), where should the authorization decision logic be offloaded to ensure central governance?

Question 28mediummultiple choice

Read the full Identity And Access Management Architecture explanation →

What is the primary role of an 'Attribute-Based Access Control' (ABAC) system compared to 'Role-Based Access Control' (RBAC)?

Question 29mediummultiple choice

Read the full Identity And Access Management Architecture explanation →

In a SAML-based federation, what is the purpose of the 'RelayState' parameter?

Question 30hardmultiple choice

Read the full Identity And Access Management Architecture explanation →

You are designing an IAM architecture for a global enterprise. You must ensure that PII is not transmitted in cleartext within identity tokens. What is the standard security requirement?

Question 31mediummultiple choice

Read the full Identity And Access Management Architecture explanation →

What is the function of 'Token Introspection' in OAuth 2.0?

Question 32mediummultiple choice

Read the full Identity And Access Management Architecture explanation →

You are troubleshooting an OIDC flow where the client fails to fetch the user information. What is the correct OIDC endpoint to call?

Question 33easymultiple choice

Read the full Identity And Access Management Architecture explanation →

What is the primary risk of 'Standing Privileges'?

Question 34mediummultiple choice

Read the full Identity And Access Management Architecture explanation →

Which component in a Privileged Access Management (PAM) solution is responsible for 'Credential Rotation'?

Question 35hardmultiple choice

Read the full Identity And Access Management Architecture explanation →

What is the primary architectural purpose of a 'Security Token Service' (STS) in a federated environment?

Question 36mediummultiple choice

Read the full Identity And Access Management Architecture explanation →

When migrating to a Zero Trust architecture, what is the recommended approach for legacy applications that do not support modern authentication protocols (SAML/OIDC)?

Question 37hardmulti select

Read the full Identity And Access Management Architecture explanation →

Which TWO security properties are provided by modern 'Passwordless' architectures?

Question 38mediummultiple choice

Read the full Identity And Access Management Architecture explanation →

What is the purpose of 'JWT Validation' on a resource server?

Question 39mediummulti select

Read the full Identity And Access Management Architecture explanation →

Which TWO factors are mandatory for a secure 'MFA' implementation?

Question 40mediummulti select

Read the full Identity And Access Management Architecture explanation →

Which THREE components are involved in a standard OIDC authentication flow?

Question 41mediummulti select

Read the full Identity And Access Management Architecture explanation →

Which TWO actions should be taken when designing a highly available IAM architecture?

Question 42mediummulti select

Read the full Identity And Access Management Architecture explanation →

Which THREE criteria are typically evaluated by a Policy Decision Point (PDP) in a Zero Trust environment?

Question 43mediummulti select

Read the full Identity And Access Management Architecture explanation →

Which THREE types of claims are typically included in a JSON Web Token (JWT)?

Question 44mediummulti select

Read the full Identity And Access Management Architecture explanation →

Which TWO components are critical for an identity-centric Zero Trust architecture?

Question 45mediummulti select

Read the full Identity And Access Management Architecture explanation →

Which THREE features are essential for a modern IAM Lifecycle Management (LCM) system?

Question 46hardmulti select

Read the full Identity And Access Management Architecture explanation →

Which TWO methods are used to prevent 'Token Replay' attacks in an OAuth/OIDC architecture?

Question 47mediummulti select

Read the full Identity And Access Management Architecture explanation →

Which THREE attributes of a user session are typically monitored by a CASB (Cloud Access Security Broker)?

Question 48hardmulti select

Read the full Identity And Access Management Architecture explanation →

Which THREE security mechanisms are recommended when using an API Gateway to handle authentication?

Question 49mediummulti select

Read the full Identity And Access Management Architecture explanation →

Which TWO types of certificates are used in a standard mTLS implementation?

Question 50hardmulti select

Read the full Identity And Access Management Architecture explanation →

Which THREE components are critical to ensuring secure 'Just-In-Time' (JIT) access?

Question 51hardmultiple choice

Read the full Identity And Access Management Architecture explanation →

An ISSAP architect is configuring Azure AD (Entra ID) Conditional Access policies to enforce Zero Trust. The requirement is to ensure that users accessing sensitive applications are verified as compliant with Intune device status. Which assignment condition is required?

Question 52easymultiple choice

Read the full Identity And Access Management Architecture explanation →

Which architectural principle is fundamental to implementing Zero Trust in a microservices environment?

Question 53hardmultiple choice

Read the full Identity And Access Management Architecture explanation →

In a SAML 2.0 federation, an Identity Provider (IdP) is failing to authenticate users because the Service Provider (SP) cannot verify the assertion integrity. The SP requires the IdP to sign the assertion. What must be exchanged to solve this?

Question 54mediummultiple choice

Read the full Identity And Access Management Architecture explanation →

A firm is deploying a Just-In-Time (JIT) access model using CyberArk. Which component architecture is required to perform privileged session recording while ensuring the vault is not directly exposed to the internet?

Question 55mediummultiple choice

Read the full Identity And Access Management Architecture explanation →

An organization is migrating to SCIM (System for Cross-domain Identity Management) for automated provisioning. Which entity is responsible for receiving the provisioning request from the Identity Provider?

Question 56hardmultiple choice

Read the full Identity And Access Management Architecture explanation →

You are designing an OIDC implementation. An application needs to obtain user profile information without including it in the ID Token to keep the token size small. Which endpoint should the application call?

Question 57mediummulti select

Read the full Identity And Access Management Architecture explanation →

Which THREE features are essential for a robust Privileged Access Management (PAM) architecture that adheres to the principle of least privilege?

Question 58mediummulti select

Read the full Identity And Access Management Architecture explanation →

Which THREE attributes should be evaluated when defining access policies in a modern Zero Trust Architecture?

Question 59hardmulti select

Read the full Identity And Access Management Architecture explanation →

When designing a Federated Identity architecture using OIDC/SAML, which TWO security considerations are critical for the Relying Party (SP)?

Question 1mediummultiple choice

Read the full Identity And Access Management Architecture explanation →

In a SAML 2.0 federation architecture, the Service Provider (SP) returns a 403 error during the assertion consumption phase. After verifying the digital signature, what is the most likely cause?

Question 2mediummultiple choice

Read the full Identity And Access Management Architecture explanation →

You are implementing Zero Trust Network Access (ZTNA) using Zscaler Private Access (ZPA). Which component is responsible for the actual interception and brokering of the connection between the user and the private application?

Question 3hardmultiple choice

Read the full Identity And Access Management Architecture explanation →

When deploying HashiCorp Vault for secrets management, you need to implement a 'Dynamic Secrets' architecture for database access. Which workflow is correct?

Question 4mediummultiple choice

Read the full Identity And Access Management Architecture explanation →

Which protocol is the industry standard for automating the exchange of user identity information between an Identity Provider and a Service Provider?

Question 5hardmultiple choice

Read the full Identity And Access Management Architecture explanation →

You are auditing an OAuth 2.0 implementation. You discover that the application uses the 'Implicit Grant' flow. Why is this considered an architectural security weakness?

Question 6hardmultiple choice

Read the full Identity And Access Management Architecture explanation →

You are configuring an AWS IAM policy to allow a user to list S3 buckets only if they are connected from a specific IP range. Which policy element is required?

Question 7hardmulti select

Read the full Identity And Access Management Architecture explanation →

Which TWO risks are significantly mitigated by implementing a Privileged Access Management (PAM) vault?

Question 8mediummulti select

Read the full Identity And Access Management Architecture explanation →

Which TWO concepts are central to 'Federated Identity'?

Question 9hardmulti select

Read the full Identity And Access Management Architecture explanation →

Which THREE mechanisms are commonly used to secure the 'Authorization Code' in an OAuth 2.0 flow?

Question 10mediummultiple choice

Read the full Identity And Access Management Architecture explanation →

An architect is designing an OAuth 2.0 implementation for a mobile application. To prevent authorization code injection attacks, which specific configuration must be enforced in the client registration?

Question 11mediummultiple choice

Read the full Identity And Access Management Architecture explanation →

In a Zero Trust architecture, what is the primary role of a Policy Decision Point (PDP)?

Question 12mediummultiple choice

Read the full Identity And Access Management Architecture explanation →

When designing a privileged access management (PAM) solution using CyberArk, you must ensure that privileged credentials are never exposed to the end-user workstation. Which feature facilitates this?

Question 13hardmultiple choice

Read the full Identity And Access Management Architecture explanation →

You are configuring an AWS IAM Identity Center (successor to AWS SSO) environment. You need to provide temporary, elevated access to a developer for a specific account. Which mechanism provides the most granular architectural approach for this?

Question 14hardmultiple choice

Read the full Identity And Access Management Architecture explanation →

You are deploying OIDC (OpenID Connect) for a web application. You need to prevent token replay attacks. Which claim should the application validate in the ID Token?

Question 15mediummultiple choice

Read the full Identity And Access Management Architecture explanation →

You are designing an Azure AD (Entra ID) Conditional Access policy to restrict access to sensitive applications. You need to ensure that only compliant, managed devices can access the resource. Which Grant control must be configured?

Question 16hardmultiple choice

Read the full Identity And Access Management Architecture explanation →

You are architecting a solution to mitigate 'Token Theft' in a Zero Trust environment. Which mechanism binds a token to a specific client instance?

Question 17mediummultiple choice

Read the full Identity And Access Management Architecture explanation →

When implementing FIDO2/WebAuthn for passwordless authentication, where does the private key reside?

Question 18easymultiple choice

Read the full Identity And Access Management Architecture explanation →

In a cloud architecture, what does the 'Principle of Least Privilege' (PoLP) imply regarding IAM roles?

Question 19easymultiple choice

Read the full Identity And Access Management Architecture explanation →

What is the primary architectural purpose of implementing Just-in-Time (JIT) access?

Question 20mediummultiple choice

Read the full Identity And Access Management Architecture explanation →

You are implementing an IdP-initiated SSO flow. What is the primary architectural requirement for the SP?

Question 21mediummultiple choice

Read the full Identity And Access Management Architecture explanation →

What is the purpose of 'Claims Transformation' in an Identity Provider?

Question 22easymultiple choice

Read the full Identity And Access Management Architecture explanation →

Which authentication factor is considered 'inherence'?

Question 23hardmultiple choice

Read the full Identity And Access Management Architecture explanation →

You are securing a microservices architecture using mTLS. Which party is responsible for issuing the certificates that identify each service?

Question 24mediummultiple choice

Read the full Identity And Access Management Architecture explanation →

In the context of the OAuth 2.0 Authorization Code flow, why is the 'client_secret' never sent to the user's browser?

Question 25mediummultiple choice

Read the full Identity And Access Management Architecture explanation →

What is the primary function of an 'Identity Bridge' in a hybrid architecture?

Question 26mediummultiple choice

Read the full Identity And Access Management Architecture explanation →

What is the benefit of using 'Scoped Access Tokens' in an OAuth architecture?

Question 27hardmultiple choice

Read the full Identity And Access Management Architecture explanation →

When using an API Gateway as a Policy Enforcement Point (PEP), where should the authorization decision logic be offloaded to ensure central governance?

Question 28mediummultiple choice

Read the full Identity And Access Management Architecture explanation →

What is the primary role of an 'Attribute-Based Access Control' (ABAC) system compared to 'Role-Based Access Control' (RBAC)?

Question 29mediummultiple choice

Read the full Identity And Access Management Architecture explanation →

In a SAML-based federation, what is the purpose of the 'RelayState' parameter?

Question 30hardmultiple choice

Read the full Identity And Access Management Architecture explanation →

You are designing an IAM architecture for a global enterprise. You must ensure that PII is not transmitted in cleartext within identity tokens. What is the standard security requirement?

Question 31mediummultiple choice

Read the full Identity And Access Management Architecture explanation →

What is the function of 'Token Introspection' in OAuth 2.0?

Question 32mediummultiple choice

Read the full Identity And Access Management Architecture explanation →

You are troubleshooting an OIDC flow where the client fails to fetch the user information. What is the correct OIDC endpoint to call?

Question 33easymultiple choice

Read the full Identity And Access Management Architecture explanation →

What is the primary risk of 'Standing Privileges'?

Question 34mediummultiple choice

Read the full Identity And Access Management Architecture explanation →

Which component in a Privileged Access Management (PAM) solution is responsible for 'Credential Rotation'?

Question 35hardmultiple choice

Read the full Identity And Access Management Architecture explanation →

What is the primary architectural purpose of a 'Security Token Service' (STS) in a federated environment?

Question 36mediummultiple choice

Read the full Identity And Access Management Architecture explanation →

When migrating to a Zero Trust architecture, what is the recommended approach for legacy applications that do not support modern authentication protocols (SAML/OIDC)?

Question 37hardmulti select

Read the full Identity And Access Management Architecture explanation →

Which TWO security properties are provided by modern 'Passwordless' architectures?

Question 38mediummultiple choice

Read the full Identity And Access Management Architecture explanation →

What is the purpose of 'JWT Validation' on a resource server?

Question 39mediummulti select

Read the full Identity And Access Management Architecture explanation →

Which TWO factors are mandatory for a secure 'MFA' implementation?

Question 40mediummulti select

Read the full Identity And Access Management Architecture explanation →

Which THREE components are involved in a standard OIDC authentication flow?

Question 41mediummulti select

Read the full Identity And Access Management Architecture explanation →

Which TWO actions should be taken when designing a highly available IAM architecture?

Question 42mediummulti select

Read the full Identity And Access Management Architecture explanation →

Which THREE criteria are typically evaluated by a Policy Decision Point (PDP) in a Zero Trust environment?

Question 43mediummulti select

Read the full Identity And Access Management Architecture explanation →

Which THREE types of claims are typically included in a JSON Web Token (JWT)?

Question 44mediummulti select

Read the full Identity And Access Management Architecture explanation →

Which TWO components are critical for an identity-centric Zero Trust architecture?

Question 45mediummulti select

Read the full Identity And Access Management Architecture explanation →

Which THREE features are essential for a modern IAM Lifecycle Management (LCM) system?

Question 46hardmulti select

Read the full Identity And Access Management Architecture explanation →

Which TWO methods are used to prevent 'Token Replay' attacks in an OAuth/OIDC architecture?

Question 47mediummulti select

Read the full Identity And Access Management Architecture explanation →

Which THREE attributes of a user session are typically monitored by a CASB (Cloud Access Security Broker)?

Question 48hardmulti select

Read the full Identity And Access Management Architecture explanation →

Which THREE security mechanisms are recommended when using an API Gateway to handle authentication?

Question 49mediummulti select

Read the full Identity And Access Management Architecture explanation →

Which TWO types of certificates are used in a standard mTLS implementation?

Question 50hardmulti select

Read the full Identity And Access Management Architecture explanation →

Which THREE components are critical to ensuring secure 'Just-In-Time' (JIT) access?

Question 51hardmultiple choice

Read the full Identity And Access Management Architecture explanation →

An ISSAP architect is configuring Azure AD (Entra ID) Conditional Access policies to enforce Zero Trust. The requirement is to ensure that users accessing sensitive applications are verified as compliant with Intune device status. Which assignment condition is required?

Question 52easymultiple choice

Read the full Identity And Access Management Architecture explanation →

Which architectural principle is fundamental to implementing Zero Trust in a microservices environment?

Question 53hardmultiple choice

Read the full Identity And Access Management Architecture explanation →

In a SAML 2.0 federation, an Identity Provider (IdP) is failing to authenticate users because the Service Provider (SP) cannot verify the assertion integrity. The SP requires the IdP to sign the assertion. What must be exchanged to solve this?

Question 54mediummultiple choice

Read the full Identity And Access Management Architecture explanation →

A firm is deploying a Just-In-Time (JIT) access model using CyberArk. Which component architecture is required to perform privileged session recording while ensuring the vault is not directly exposed to the internet?

Question 55mediummultiple choice

Read the full Identity And Access Management Architecture explanation →

An organization is migrating to SCIM (System for Cross-domain Identity Management) for automated provisioning. Which entity is responsible for receiving the provisioning request from the Identity Provider?

Question 56hardmultiple choice

Read the full Identity And Access Management Architecture explanation →

You are designing an OIDC implementation. An application needs to obtain user profile information without including it in the ID Token to keep the token size small. Which endpoint should the application call?

Question 57mediummulti select

Read the full Identity And Access Management Architecture explanation →

Which THREE features are essential for a robust Privileged Access Management (PAM) architecture that adheres to the principle of least privilege?

Question 58mediummulti select

Read the full Identity And Access Management Architecture explanation →

Which THREE attributes should be evaluated when defining access policies in a modern Zero Trust Architecture?

Question 59hardmulti select

Read the full Identity And Access Management Architecture explanation →