CCNA Identity And Access Management Architecture Questions

MFA requires at least two distinct authentication factors from different categories (e.g., possession and knowledge).

PoLP requires that identities are granted only the minimum permissions necessary to perform their assigned task, for the minimum duration required.

Zero Trust evaluates the context of the user, the device, and the resource being accessed to make a dynamic decision.

A central Identity Provider (IdP) and the establishment of 'Trust' between organizations are the core concepts of federation.

The 'Condition' block is used to enforce context-based restrictions, such as 'aws:SourceIp', within an IAM policy.

In FIDO2, the private key is stored securely on the local authenticator (e.g., TPM, Secure Enclave, or hardware security key) and never leaves the device.

Zero Trust assumes the network is compromised, requiring explicit verification for every request, typically via identity-based micro-segmentation.

Inherence factors are based on something the user is, such as biometrics (fingerprint, iris scan, facial recognition).

DPoP and nonces are both techniques used to bind tokens to the specific request session, preventing replay.

The End User, the Relying Party (RP/Client), and the OpenID Provider (OP/IdP) are the standard actors in the OIDC flow.

The PSM (Privileged Session Manager) acts as a proxy, allowing session recording and isolation without exposing the vault directly to the endpoint.

The PDP is the architectural component that evaluates requests against predefined policies and returns an allow or deny decision to the Policy Enforcement Point (PEP).

The UserInfo endpoint (defined in the OIDC discovery metadata) is used to retrieve claims about the authenticated user using an access token.

Credential theft (from local storage) and persistent standing privileges are primary risks mitigated by PAM vaults.

A Private Certificate Authority (CA) or a Service Mesh (like Istio) acting as a CA is responsible for issuing and rotating certificates for service-to-service authentication.

The PAM vaulting component (e.g., CyberArk Vault, HashiCorp Vault) is responsible for automatically updating and rotating passwords on target systems based on defined policies.

RelayState is used to maintain the state of the user's intended destination URL, ensuring the user is redirected to the correct page after authentication.

The Service Provider (or Target Application) acts as the SCIM Server, receiving requests from the Client (IdP) to create, update, or delete users.

CASBs monitor user location, device state, and the specific application activity (actions taken).

Rate limiting (DDoS protection), authentication validation (at the edge), and logging (audit) are standard API Gateway security controls.

AWS IAM Identity Center Permission Sets allow you to define granular access scoped to specific accounts, which can be assigned to users on-demand or via group membership.

FIDO2/WebAuthn eliminates shared secrets (passwords) and provides phishing resistance via origin binding.

mTLS requires both a Server Certificate (to verify the server identity) and a Client Certificate (to verify the client identity).

PKCE (Proof Key for Code Exchange) is the standard defense against authorization code interception attacks in public clients, replacing the need for a client secret.

ABAC uses dynamic attributes (user, environment, resource) to make fine-grained decisions, whereas RBAC relies on static assignments of users to roles.

The client secret is a shared secret between the Authorization Server and the application. If exposed to the browser, it can be easily extracted and used by attackers to impersonate the client.

Scopes limit the permissions (actions and resources) associated with a specific token, ensuring that if a token is compromised, the attacker's capabilities are restricted.

The Implicit Grant returns access tokens directly in the URL fragment, which is susceptible to browser history leaks, referrer header exposure, and interception via malicious extensions.

Redundancy of the IdP (multi-region/multi-cloud) and geo-replication of the directory service are critical for high availability in IAM.

CyberArk PSM (Privileged Session Manager) provides an isolated 'jump' environment where the session is proxied, keeping the actual target credentials hidden from the end-user.

An identity bridge connects disparate identity systems (e.g., on-premises AD and cloud-based IdP) to provide a unified authentication experience.

Credential vaulting, session recording, and granular access delegation are core pillars of PAM.

An Identity-Aware Proxy (IAP) can act as a modern authentication frontend for legacy apps, handling the modern auth flow and passing the identity to the backend via headers or Kerberos.

The SP must be configured to receive and validate the unsolicited SAML assertion sent by the IdP to the assertion consumer service (ACS) endpoint.

HTTPS (transport security), PKCE (binding code to request), and short-lived tokens/codes are standard security measures.

Automated provisioning, role-based access assignment, and automated de-provisioning are pillars of IAM LCM.

The 'Require device to be marked as compliant' control enforces that the device must be registered in Intune and meet all defined compliance policies before access is granted.

Standing privileges are permissions that remain active indefinitely, providing a permanent window for an attacker to exploit if the account is compromised.

The 'Require device to be marked as compliant' grant control is the specific mechanism in Entra ID to bridge device compliance state from Intune to access decisions.

Validation ensures that the JWT is authentic (signature check), has not expired (exp claim), and was issued by a trusted entity (iss claim) before granting access.

The UserInfo endpoint is the OIDC standard for fetching claims about the authenticated user using an Access Token.

Registered claims (standardized), Private claims (custom), and Public claims (namespaced) are the types of claims in JWT.

SCIM (System for Cross-domain Identity Management) is the standard designed to facilitate the exchange of user identity information between systems.

For the SP to verify the IdP's signature on an assertion, the SP must possess the IdP's public certificate.

The gateway should delegate authorization decisions to a Policy Decision Point (PDP), such as an Open Policy Agent (OPA) server, to maintain consistent policy across services.

A central Identity Provider (IdP) and a Policy Decision Point (PDP) are the structural heart of a ZT identity architecture.

Identity context, device posture, and network/location context are the 'Three Pillars' of ZT policy evaluation.

Claims transformation allows the IdP to map or modify attributes from a source directory (like AD) into a format expected by the target application (SAML/OIDC).

JIT access reduces the attack surface by ensuring that high-privilege access is only active when needed, rather than remaining persistent.

DPoP (Demonstrating Proof-of-Possession) binds tokens to a private key held by the client, ensuring that even if a token is stolen, it cannot be used without the accompanying private key.

Token Introspection (RFC 7662) allows a resource server to verify the validity and state (active/inactive) of an access token with the Authorization Server.

The dynamic secret workflow involves Vault generating unique, short-lived database credentials on-the-fly for every request, which are automatically revoked upon expiry.

An STS acts as the central issuing authority that validates incoming requests and issues security tokens (SAML, JWT) for access to downstream services.

PII should be encrypted within tokens (e.g., using JWE - JSON Web Encryption) or minimized in the token payload to meet privacy regulations.

Validating the token signature and checking the audience claim are the two most critical steps to prevent token spoofing or replay attacks.

A central request workflow, time-bound approval (TTL), and automated revocation are the three pillars of a secure JIT architecture.

The Zscaler App Connector initiates an outbound-only connection to the Zscaler cloud, where the ZPA broker connects the user to the application without exposing the application to the internet.

The 'nonce' claim is a cryptographically strong value that links the request to the response, allowing the client to verify that the ID Token was generated specifically for its request.

If the signature is valid but access is denied, the NameID or attributes in the assertion often do not match the expected user mapping or authorization requirements at the SP.