Identity and Access Management

A developer is implementing OAuth 2.0 for a mobile app (public client) that needs to access a user's data from a third-party API. To mitigate the authorization code interception attack, which OAuth 2.0 extension should be used?

Which access control model assigns permissions based on a user's job function?

A security policy requires that a user cannot have both the ability to create purchase orders and approve invoices. This is an example of:

A security analyst is performing an access review. Which THREE of the following are best practices for user access recertification? (Choose three.)

Which TWO of the following are examples of Type 3 authentication factors? (Choose two.)

A security analyst is reviewing access controls for a financial application. Which TWO of the following are considered best practices for preventing fraud? (Select TWO.)

In SAML 2.0, which component is responsible for authenticating the user and generating an assertion?

Which TWO of the following are OAuth 2.0 grant types? (Choose two.)

Which access control model bases decisions on attributes of the user, resource, and environment, and can use Boolean logic to define policies?

An organization wants to enable single sign-on (SSO) across multiple web applications using an XML-based protocol that supports browser redirect flows. Which technology is most appropriate?

Which authentication factor type is a smart card?

OpenID Connect (OIDC) extends OAuth 2.0 primarily by adding which capability?

A multinational bank must enforce least privilege across 4,000 roles that change frequently as employees move between trading, compliance, and IT functions. Auditors found that access reviews are performed manually and that role definitions drift from actual job duties. The identity team proposes a role mining and management program. Which approach best aligns with identity and access management governance objectives while reducing role explosion?

In an OAuth 2.0 authorization code flow with PKCE, what is the primary purpose of the code verifier and code challenge?

A security administrator is configuring a system that requires users to provide a password and a one-time code from a hardware token. Which authentication method is being implemented?

During a Kerberos authentication process, the client receives a Ticket Granting Ticket (TGT) from the Authentication Server (AS). Later, the client presents the TGT to the Ticket Granting Server (TGS) to request a service ticket. Which of the following best describes the purpose of the TGT?

An organization discovers that a former employee's account is still active and has been used to access sensitive data. This is an example of which type of risk?

A security administrator is reviewing potential risks associated with orphaned accounts. Which TWO of the following are risks of orphaned accounts?

A healthcare organization uses a federated identity provider (IdP) to authenticate clinicians into a third-party electronic health record (EHR) application acting as a SAML 2.0 Service Provider (SP). The security team wants to reduce the risk that a stolen IdP session cookie could be replayed against the EHR. Which SAML 2.0 control should the team implement to bind the assertion to the authenticated browser session and limit replay?

Which of the following is an example of a Type 1 authentication factor?

An attacker who has compromised the Kerberos Key Distribution Center (KDC) could forge a Ticket Granting Ticket (TGT) to impersonate any user. This type of attack is known as:

In OAuth 2.0, which grant type is recommended for a native mobile application that cannot securely store a client secret, and uses PKCE?

In a Privileged Access Management (PAM) solution, which feature provides temporary elevation of privileges for specific tasks, reducing the risk of standing privileges?

Which TWO of the following are characteristics of a Privileged Access Management (PAM) solution? (Choose two.)

An organization is implementing a Privileged Access Management (PAM) solution. Which THREE of the following are common features of PAM? (Select THREE.)

Which THREE of the following are components of a Privileged Access Management (PAM) solution?

Which of the following is an example of a Type 2 authentication factor?

A security architect is designing an authentication system for a healthcare application that requires strong security. The system will use a password and a one-time passcode sent via SMS. How many authentication factor types are being used?

Which access control model allows the owner of a resource to determine who can access it and what permissions they have?

In Kerberos authentication, what is the purpose of the Ticket Granting Ticket (TGT)?

An LDAP distinguished name (DN) includes the attribute 'CN=John Doe,OU=Sales,DC=company,DC=com'. What does 'CN' stand for?

Which TWO of the following are differences between OAuth 2.0 and OpenID Connect (OIDC)?

An organization implements Single Sign-On (SSO) using SAML 2.0. A user attempts to access a cloud application (Service Provider) but is not authenticated. The Service Provider redirects the user to the Identity Provider (IdP) for authentication. Which type of SAML flow is this?

An organization wants to implement single sign-on across multiple web applications using an XML-based protocol that supports identity provider (IdP) and service provider (SP) initiated flows. Which technology should they choose?

Which protocol is specifically designed for authorization and not authentication, often using grant types like authorization code and client credentials?

In Kerberos authentication, which component issues a Ticket Granting Ticket (TGT) after verifying the user's credentials?

In LDAP, what does the Distinguished Name (DN) uniquely identify?

Which principle ensures that a user is granted only the permissions necessary to perform their job functions?

A security analyst discovers that an attacker has gained domain admin privileges by forging a Kerberos TGT using the KRBTGT account hash. Which attack has occurred?

An organization implements Privileged Access Management (PAM) and wants to reduce the risk of standing privileges. Which approach grants temporary elevated access only when needed?

Which of the following is a lightweight directory access protocol used for accessing and maintaining distributed directory information?

A financial application requires two employees to authorize a wire transfer. Which principle does this implement?

An organization is implementing OpenID Connect (OIDC) for authentication. Which THREE of the following are components of OIDC? (Choose three.)

An employee leaves the company, and their user account is not disabled. This creates a security risk known as:

Which OAuth 2.0 grant type is recommended for a public client (e.g., single-page application) that cannot securely store a client secret?

An organization is implementing identity management and wants to ensure that when an employee leaves, all access is promptly revoked. Which process is most directly responsible for removing accounts and access rights for a leaver?

In the context of identity management, which TWO of the following are risks associated with orphaned accounts? (Choose two.)

An organization wants to provide just-in-time administrative access to servers, with session recording and password vaulting. Which solution is best suited?

Which of the following is a process that ensures users periodically confirm they still need access to systems and data?

In LDAP, which attribute uniquely identifies an entry within the directory information tree?

A financial services firm is deploying a customer-facing mobile banking app and wants to delegate limited access to account balances and transaction history to third-party budgeting apps without sharing the customer's banking credentials. The security architect must select controls that implement this delegation securely. (Choose two.)

A financial institution requires that no single employee can approve a transaction and also reconcile the account. This is an example of which security principle?

A security analyst is reviewing access rights and discovers an active account belonging to a former employee who left six months ago. This is an example of: