ISC Identity And Access Management Architecture Practice Test 2 — 15 Questions

Question 1

You are architecting a solution to mitigate 'Token Theft' in a Zero Trust environment. Which mechanism binds a token to a specific client instance?

Accepted Answer

DPoP (Demonstrating Proof-of-Possession). DPoP (Demonstrating Proof-of-Possession) binds tokens to a private key held by the client, ensuring that even if a token is stolen, it cannot be used without the accompanying private key.

Answer

PKCE (Proof Key for Code Exchange)

Answer

Refresh Token Rotation

Answer

MFA step-up

Question 2

When implementing FIDO2/WebAuthn for passwordless authentication, where does the private key reside?

Accepted Answer

On the user's local hardware authenticator.. In FIDO2, the private key is stored securely on the local authenticator (e.g., TPM, Secure Enclave, or hardware security key) and never leaves the device.

Answer

In the Identity Provider's database.

Answer

In the browser's encrypted cache.

Answer

In the server-side hardware security module (HSM).

Question 3

In a cloud architecture, what does the 'Principle of Least Privilege' (PoLP) imply regarding IAM roles?

Accepted Answer

Permissions should be granted based on the user's job role and the specific resources needed.. PoLP requires that identities are granted only the minimum permissions necessary to perform their assigned task, for the minimum duration required.

Answer

All users should have read access to the root directory.

Answer

Administrators should have full control over all cloud resources.

Answer

Roles should be static and never changed to ensure stability.

Question 4

What is the primary architectural purpose of implementing Just-in-Time (JIT) access?

Accepted Answer

To minimize the window of opportunity for attackers to exploit standing privileges.. JIT access reduces the attack surface by ensuring that high-privilege access is only active when needed, rather than remaining persistent.

Answer

To eliminate the need for an identity provider.

Answer

To increase user productivity by removing MFA requirements.

Answer

To automate user provisioning and deprovisioning.

Question 5

You are implementing an IdP-initiated SSO flow. What is the primary architectural requirement for the SP?

Accepted Answer

The SP must have a pre-configured trust relationship with the IdP's metadata.. In an IdP-initiated SSO flow, the identity provider generates and sends a SAML assertion directly to the service provider without the user first visiting the SP. For the SP to accept and validate this unsolicited assertion, it must have a pre-configured trust relationship with the IdP, established through exchanged metadata containing the IdP's signing certificate, entity ID, and SSO endpoint. Without this trust anchor, the SP cannot verify the assertion's authenticity.

Answer

The SP must utilize LDAP over SSL for the assertion.

Answer

The SP must redirect the user to the IdP login page.

Answer

The SP must poll the IdP for a login event.

Question 6

What is the purpose of 'Claims Transformation' in an Identity Provider?

Accepted Answer

To convert user attributes from one format to another.. Claims transformation allows the IdP to map or modify attributes from a source directory (like AD) into a format expected by the target application (SAML/OIDC).

Answer

To encrypt the entire user session.

Answer

To authenticate users against multiple directories simultaneously.

Answer

To store authentication logs in a central repository.

Question 7

Which authentication factor is considered 'inherence'?

Accepted Answer

A fingerprint scan.. Inherence factors are based on something the user is, such as biometrics (fingerprint, iris scan, facial recognition).

Answer

A strong passphrase.

Answer

A one-time password (OTP).

Answer

A hardware security key.

Question 8

You are securing a microservices architecture using mTLS. Which party is responsible for issuing the certificates that identify each service?

Accepted Answer

Internal Certificate Authority (CA). A Private Certificate Authority (CA) or a Service Mesh (like Istio) acting as a CA is responsible for issuing and rotating certificates for service-to-service authentication.

Answer

The API Gateway

Answer

The Load Balancer

Answer

The Identity Provider (IdP)

Question 9

In the context of the OAuth 2.0 Authorization Code flow, why is the 'client_secret' never sent to the user's browser?

Accepted Answer

Because it must be kept confidential on the backend server.. The client_secret is a confidential credential that authenticates the client application to the authorization server. It must remain on the backend server and never be exposed to the browser, because the browser is an untrusted environment where the secret could be intercepted or extracted. This is why C is correct.

Answer

Because the client secret is only used for PKCE.

Answer

Because the browser does not support SSL.

Answer

Because browsers block outbound requests with secrets.

Question 10

What is the primary function of an 'Identity Bridge' in a hybrid architecture?

Accepted Answer

To federate identity between on-premises and cloud environments.. An identity bridge connects disparate identity systems (e.g., on-premises AD and cloud-based IdP) to provide a unified authentication experience.

Answer

To store user passwords in a central vault.

Answer

To enforce network firewall rules.

Answer

To perform real-time user activity monitoring.

Question 11

What is the benefit of using 'Scoped Access Tokens' in an OAuth architecture?

Accepted Answer

It restricts the level of access granted to the client application.. Scopes limit the permissions (actions and resources) associated with a specific token, ensuring that if a token is compromised, the attacker's capabilities are restricted.

Answer

It enables automatic token rotation.

Answer

It eliminates the need for MFA.

Answer

It reduces the size of the token.

Question 12

When using an API Gateway as a Policy Enforcement Point (PEP), where should the authorization decision logic be offloaded to ensure central governance?

Accepted Answer

To a centralized Policy Decision Point (PDP).. The gateway should delegate authorization decisions to a Policy Decision Point (PDP), such as an Open Policy Agent (OPA) server, to maintain consistent policy across services.

Answer

Hardcoded within the API Gateway configuration.

Answer

Within the backend microservice code.

Answer

Inside the client's browser.

Question 13

What is the primary role of an 'Attribute-Based Access Control' (ABAC) system compared to 'Role-Based Access Control' (RBAC)?

Accepted Answer

ABAC provides more granular control using environmental and resource attributes.. ABAC grants or denies access based on a combination of attributes—user attributes (e.g., department, clearance), resource attributes (e.g., classification, owner), action attributes (e.g., read, write), and environmental attributes (e.g., time of day, location, device posture). This multidimensional evaluation enables fine-grained, context-aware policies that RBAC cannot express, since RBAC only maps static roles to permissions. Thus, ABAC's primary advantage is its granularity and dynamic adaptability, not speed of implementation or elimination of identity infrastructure.

Answer

ABAC eliminates the need for an Identity Provider.

Answer

ABAC relies exclusively on user hierarchy.

Answer

ABAC is faster to implement.

Question 14

In a SAML-based federation, what is the purpose of the 'RelayState' parameter?

Accepted Answer

To redirect the user to a specific resource after authentication.. RelayState is used to maintain the state of the user's intended destination URL, ensuring the user is redirected to the correct page after authentication.

Answer

To provide the assertion signature.

Answer

To define the authentication method.

Answer

To encrypt the NameID.

Question 15

You are designing an IAM architecture for a global enterprise. You must ensure that PII is not transmitted in cleartext within identity tokens. What is the standard security requirement?

Accepted Answer

Implement JSON Web Encryption (JWE).. PII should be encrypted within tokens (e.g., using JWE - JSON Web Encryption) or minimized in the token payload to meet privacy regulations.

Answer

Use JWT exclusively.

Answer

Use symmetric keys for all token signing.

Answer

Disable all claims in the token.