ISC Identity And Access Management Architecture — Timed 10 Questions

Question 1

In a SAML 2.0 federation architecture, the Service Provider (SP) returns a 403 error during the assertion consumption phase. After verifying the digital signature, what is the most likely cause?

Accepted Answer

Subject NameID mismatch. If the signature is valid but access is denied, the NameID or attributes in the assertion often do not match the expected user mapping or authorization requirements at the SP.

Answer

Encryption algorithm mismatch

Answer

Expired metadata

Answer

Assertion Consumer Service (ACS) URL mismatch

Question 2

You are implementing Zero Trust Network Access (ZTNA) using Zscaler Private Access (ZPA). Which component is responsible for the actual interception and brokering of the connection between the user and the private application?

Accepted Answer

Zscaler Cloud Broker. The Zscaler App Connector initiates an outbound-only connection to the Zscaler cloud, where the ZPA broker connects the user to the application without exposing the application to the internet.

Answer

Zscaler Client Connector

Answer

Zscaler App Connector

Answer

Zscaler Central Authority

Question 3

When deploying HashiCorp Vault for secrets management, you need to implement a 'Dynamic Secrets' architecture for database access. Which workflow is correct?

Accepted Answer

Vault requests a new user creation from the DB via a configured engine and returns those credentials to the client.. The dynamic secret workflow involves Vault generating unique, short-lived database credentials on-the-fly for every request, which are automatically revoked upon expiry.

Answer

Clients authenticate to the DB via Vault using LDAP delegation.

Answer

Vault retrieves static credentials from a PKI backend and rotates them.

Answer

Vault hashes existing database passwords and stores them in transit.

Question 4

In a Zero Trust architecture, what is the primary role of a Policy Decision Point (PDP)?

Accepted Answer

To evaluate access requests against defined security policies.. The PDP is the architectural component that evaluates requests against predefined policies and returns an allow or deny decision to the Policy Enforcement Point (PEP).

Answer

To manage user identities in the directory.

Answer

To log all access attempts for compliance.

Answer

To intercept and inspect network packets.

Question 5

When designing a privileged access management (PAM) solution using CyberArk, you must ensure that privileged credentials are never exposed to the end-user workstation. Which feature facilitates this?

Accepted Answer

CyberArk PSM (Privileged Session Manager). CyberArk PSM (Privileged Session Manager) provides an isolated 'jump' environment where the session is proxied, keeping the actual target credentials hidden from the end-user.

Answer

CyberArk AIM (Application Identity Manager)

Answer

CyberArk EPM (Endpoint Privilege Manager)

Answer

CyberArk Vault Agent

Question 6

You are configuring an AWS IAM Identity Center (successor to AWS SSO) environment. You need to provide temporary, elevated access to a developer for a specific account. Which mechanism provides the most granular architectural approach for this?

Accepted Answer

Permission Sets. AWS IAM Identity Center Permission Sets allow you to define granular access scoped to specific accounts, which can be assigned to users on-demand or via group membership.

Answer

IAM User Inline Policies

Answer

Cross-account IAM Roles

Answer

IAM User Access Keys

Question 7

You are deploying OIDC (OpenID Connect) for a web application. You need to prevent token replay attacks. Which claim should the application validate in the ID Token?

Accepted Answer

nonce. The 'nonce' claim is a cryptographically strong value that links the request to the response, allowing the client to verify that the ID Token was generated specifically for its request.

Answer

iss

Answer

iat

Answer

sub

Question 8

You are designing an Azure AD (Entra ID) Conditional Access policy to restrict access to sensitive applications. You need to ensure that only compliant, managed devices can access the resource. Which Grant control must be configured?

Accepted Answer

Require device to be marked as compliant. The 'Require device to be marked as compliant' control enforces that the device must be registered in Intune and meet all defined compliance policies before access is granted.

Answer

Require password change

Answer

Require approved client app

Answer

Require hybrid Azure AD joined device

Question 9

You are architecting a solution to mitigate 'Token Theft' in a Zero Trust environment. Which mechanism binds a token to a specific client instance?

Accepted Answer

DPoP (Demonstrating Proof-of-Possession). DPoP (Demonstrating Proof-of-Possession) binds tokens to a private key held by the client, ensuring that even if a token is stolen, it cannot be used without the accompanying private key.

Answer

PKCE (Proof Key for Code Exchange)

Answer

Refresh Token Rotation

Answer

MFA step-up

Question 10

Which protocol is the industry standard for automating the exchange of user identity information between an Identity Provider and a Service Provider?

Accepted Answer

SCIM. SCIM (System for Cross-domain Identity Management) is the standard designed to facilitate the exchange of user identity information between systems.

Answer

RADIUS

Answer

SAML

Answer

LDAP