ISC Identity And Access Management Architecture Practice Test 3 — 15 Questions

Question 1

What is the function of 'Token Introspection' in OAuth 2.0?

Accepted Answer

To allow a resource server to validate a token's status.. Token Introspection (RFC 7662) allows a resource server to verify the validity and state (active/inactive) of an access token with the Authorization Server.

Answer

To generate a new token for the client.

Answer

To map the user to a new role.

Answer

To refresh an expired token.

Question 2

You are troubleshooting an OIDC flow where the client fails to fetch the user information. What is the correct OIDC endpoint to call?

Accepted Answer

UserInfo Endpoint. The UserInfo Endpoint is the correct OIDC endpoint to retrieve user information after obtaining an access token. It returns claims about the authenticated user when presented with a valid access token.

Answer

Token Endpoint

Answer

Authorization Endpoint

Answer

Discovery Endpoint

Question 3

What is the primary risk of 'Standing Privileges'?

Accepted Answer

They increase the attack surface by allowing 24/7 access.. Standing privileges are permissions that remain active indefinitely, providing a permanent window for an attacker to exploit if the account is compromised.

Answer

They are too difficult to configure.

Answer

They are not compatible with cloud IAM.

Answer

They prevent MFA from working correctly.

Question 4

Which component in a Privileged Access Management (PAM) solution is responsible for 'Credential Rotation'?

Accepted Answer

The PAM Vault/Secret Manager.. The PAM vaulting component (e.g., CyberArk Vault, HashiCorp Vault) is responsible for automatically updating and rotating passwords on target systems based on defined policies.

Answer

The MFA provider.

Answer

The jump server.

Answer

The session recorder.

Question 5

What is the primary architectural purpose of a 'Security Token Service' (STS) in a federated environment?

Accepted Answer

To mediate trust between different security domains.. An STS acts as the central issuing authority that validates incoming requests and issues security tokens (SAML, JWT) for access to downstream services.

Answer

To replace the directory service.

Answer

To store all user passwords.

Answer

To manage network traffic routing.

Question 6

When migrating to a Zero Trust architecture, what is the recommended approach for legacy applications that do not support modern authentication protocols (SAML/OIDC)?

Accepted Answer

Use an Identity-Aware Proxy (IAP).. An Identity-Aware Proxy (IAP) can act as a modern authentication frontend for legacy apps, handling the modern auth flow and passing the identity to the backend via headers or Kerberos.

Answer

Only allow access via VPN.

Answer

Rewrite the application source code.

Answer

Disable authentication for these apps.

Question 7

Which TWO security properties are provided by modern 'Passwordless' architectures?

Accepted Answer

Elimination of shared secrets.. FIDO2/WebAuthn eliminates shared secrets (passwords) and provides phishing resistance via origin binding.

Answer

Automatic network-level encryption.

Answer

Guaranteed anonymity for users.

Answer

Universal support for all legacy applications.

Question 8

What is the purpose of 'JWT Validation' on a resource server?

Accepted Answer

To ensure the token is authentic and valid.. JWT validation on a resource server ensures that the token presented by a client is authentic (signed by a trusted issuer) and valid (not expired, correct audience, etc.). This prevents unauthorized access by verifying the token's integrity and claims before granting access to protected resources.

Answer

To encrypt the token payload.

Answer

To store the user's session data.

Answer

To generate a new token.

Question 9

Which TWO factors are mandatory for a secure 'MFA' implementation?

Accepted Answer

Validation of multiple independent credentials.. MFA requires at least two distinct authentication factors from different categories (e.g., possession and knowledge).

Answer

Exclusion of any knowledge-based factors.

Answer

The use of a proprietary hardware token only.

Answer

The use of only biometric factors.

Question 10

Which THREE components are involved in a standard OIDC authentication flow?

Accepted Answer

End User. The End User, the Relying Party (RP/Client), and the OpenID Provider (OP/IdP) are the standard actors in the OIDC flow.

Answer

Certificate Authority (CA)

Answer

DNS Server

Question 11

Which TWO actions should be taken when designing a highly available IAM architecture?

Accepted Answer

Deploy identity services across multiple geographic regions.. Redundancy of the IdP (multi-region/multi-cloud) and geo-replication of the directory service are critical for high availability in IAM.

Answer

Use a single, high-performance master node.

Answer

Store all session data in a local file system.

Answer

Disable MFA to ensure faster login times.

Question 12

Which THREE criteria are typically evaluated by a Policy Decision Point (PDP) in a Zero Trust environment?

Accepted Answer

Device Posture/Health.. Identity context, device posture, and network/location context are the 'Three Pillars' of ZT policy evaluation.

Answer

The color scheme of the application.

Answer

The user's favorite browser.

Question 13

Which THREE types of claims are typically included in a JSON Web Token (JWT)?

Accepted Answer

Private claims (custom app-specific claims).. Registered claims (standardized), Private claims (custom), and Public claims (namespaced) are the types of claims in JWT.

Answer

Hardware serial number claims.

Answer

Root password claims.

Question 14

Which TWO components are critical for an identity-centric Zero Trust architecture?

Accepted Answer

Policy Decision Point (PDP).. A central Identity Provider (IdP) and a Policy Decision Point (PDP) are the structural heart of a ZT identity architecture.

Answer

A standard network firewall.

Answer

Public IP address allow-listing.

Answer

A localized directory service without replication.

Question 15

Which THREE features are essential for a modern IAM Lifecycle Management (LCM) system?

Accepted Answer

Automated de-provisioning upon employment termination.. Option A is correct because a modern IAM LCM system must automatically de-provision accounts when employment ends, disabling or deleting credentials and revoking access in near real time to prevent orphaned accounts and insider risk. Option D is correct because RBAC governance ensures access is granted based on defined roles and least privilege, with role mining, certification, and separation-of-duties controls that keep entitlements aligned to job functions. Option E is correct because automated user provisioning implements the Joiner-Mover-Leaver (JML) process, creating, updating, and removing accounts and entitlements across connected systems via standards such as SCIM to reduce manual effort and error. Option B is not correct because static account creation without audits is the opposite of lifecycle management, producing stale, unaudited entitlements and compliance failures. Option C is not correct because manual password resets via email are insecure and inefficient, whereas modern LCM relies on self-service reset, MFA, and automated credential management.

Answer

Static account creation without audits.

Answer

Manual password resets via email.